Solved

audit an AD account that login to a specific domain computer.

Posted on 2014-11-11
10
89 Views
Last Modified: 2014-12-03
Hi,

Is there a way I can tell a particular AD account that login to a specific domain computer remotely?

Thanks.

Ed
0
Comment
Question by:nav2567
  • 4
  • 3
  • 3
10 Comments
 
LVL 10

Expert Comment

by:JoeKlimis
ID: 40435072
Hi Ed

you can view the events using Powershell , further events can be added as required.

open a powershell window and paste in the following.   Remember to change the "localhost" to the required workstation.

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost 

Open in new window


This will display all the successfully logins,
0
 

Author Comment

by:nav2567
ID: 40435145
I do not see the result in the output file.  Please see the attached.  

Thanks.
result.png
0
 
LVL 10

Expert Comment

by:JoeKlimis
ID: 40435188
Hi

to all the detail of each windows event  you can do this
get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost  | fl

Open in new window



If there are just specific elements you are interested in , this can be refined, let me know your exact requirements.  
Joe
0
 

Author Comment

by:nav2567
ID: 40435407
Thanks.  

The result is now too much information..  

Is there a way I can display only the login ID and last login time for a particular system?

Thanks.
0
 
LVL 10

Expert Comment

by:JoeKlimis
ID: 40435543
Hi

Try this

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost | 
select TimeGenerated,`
@{name="Username";expression={($_.message.split(":").trim()[9] -split "Acc")[0].trim()}},`
@{name="Domain";expression={$_.message.split(":").trim()[4].split("")[0]}},`
@{name="Workstation";expression={($_.message.split(":").trim()[18] -split "source")[0].trim()}}

Open in new window

0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 16

Accepted Solution

by:
Learnctx earned 500 total points
ID: 40436309
This is a function I wrote for parsing logon events. Defaults to the localhost if a the ComputerName parameter is not set. Usage is simple:

$results = GetLogonEvents
Or
GetLogonEvents | Export-Csv -NoType whatever.csv
Or
GetLogonEvents -ComputerName ComputerNameHere

Function GetLogonEvents
{
	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults
}

Open in new window

0
 

Author Comment

by:nav2567
ID: 40439110
Learnctx, can I create a ps1 file and paste everything below and run it?  

GetLogonEvents -ComputerName SERVER_A

Function GetLogonEvents
{
      param (
            [string]$ComputerName = "localhost"
      )
      $ArrResults = New-Object System.Collections.ArrayList
      $regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
      Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
      $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
      $EventsTotal = $Events.Count
      $count = 0
      Foreach ($Event in $Events)
      {
            $count++
            $percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
            Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
            $objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
            $objResult.Time = $Event.TimeCreated
            [void]($Event.Message -match $regex)
            $objResult.user = $matches.user
            $objResult.user_domain = $matches.user_domain
            $objResult.session_id = $matches.session_id
            $objResult.msad_action = $matches.msad_action
            $objResult.workstation_name = $matches.workstation_name
            $objResult.source_network_address = $matches.source_network_address
            $objResult.source_port = $matches.source_port
            [void]$ArrResults.Add($objResult)
      }
      return $ArrResults
}


JoeKlimis, I copy yours into a notepad and put everything in one line and run it.  That doesnt work.
0
 
LVL 16

Expert Comment

by:Learnctx
ID: 40443741
OK yeah I have written it as a function to be called. You can convert it over to a script by removing the function sections. Save it as GetEventLog.ps1 or whichever name suits best.

GetEventLog.ps1 -ComputerName Computer

	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults

Open in new window

0
 

Author Comment

by:nav2567
ID: 40444072
I create a ps1 file using the above and call it from a powershell window: GetEventLog.ps1 -ComputerName server1 and see the following error:

The term 'geteventlog.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Che
ck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:18
+ geteventlog.ps1 <<<<  -ComputerName server1
    + CategoryInfo          : ObjectNotFound: (geteventlog.ps1:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


Suggestion [3,General]: The command geteventlog.ps1 was not found, but does exist in the current location. Windows Pow
erShell doesn't load commands from the current location by default. If you trust this command, instead type ".\checklogi
n_v2.ps1". See "get-help about_Command_Precedence" for more details.
0
 
LVL 16

Expert Comment

by:Learnctx
ID: 40444195
Ah yes Powershell won't execute a script from the current directory. So you either have to provide the full path (example below)...

c:\temp\scripts\scriptname.ps1

Open in new window


Or prefix the script with a .\ to tell Powershell to execute from the current directory (example below).

cd c:\temp\scripts
.\scriptname.ps1

Open in new window

0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
A procedure for exporting installed hotfix details of remote computers using powershell
In this Micro Tutorial viewers will learn how to restore single file or folder from Bare Metal backup image of their system. Tutorial shows how to restore files and folders from system backup. Often it is not needed to restore entire system when onl…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now