?
Solved

audit an AD account that login to a specific domain computer.

Posted on 2014-11-11
10
Medium Priority
?
114 Views
Last Modified: 2014-12-03
Hi,

Is there a way I can tell a particular AD account that login to a specific domain computer remotely?

Thanks.

Ed
0
Comment
Question by:nav2567
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
10 Comments
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435072
Hi Ed

you can view the events using Powershell , further events can be added as required.

open a powershell window and paste in the following.   Remember to change the "localhost" to the required workstation.

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost 

Open in new window


This will display all the successfully logins,
0
 

Author Comment

by:nav2567
ID: 40435145
I do not see the result in the output file.  Please see the attached.  

Thanks.
result.png
0
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435188
Hi

to all the detail of each windows event  you can do this
get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost  | fl

Open in new window



If there are just specific elements you are interested in , this can be refined, let me know your exact requirements.  
Joe
0
Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 

Author Comment

by:nav2567
ID: 40435407
Thanks.  

The result is now too much information..  

Is there a way I can display only the login ID and last login time for a particular system?

Thanks.
0
 
LVL 11

Expert Comment

by:Joe Klimis
ID: 40435543
Hi

Try this

get-EventLog -LogName Security -InstanceId 4624 -ComputerName localhost | 
select TimeGenerated,`
@{name="Username";expression={($_.message.split(":").trim()[9] -split "Acc")[0].trim()}},`
@{name="Domain";expression={$_.message.split(":").trim()[4].split("")[0]}},`
@{name="Workstation";expression={($_.message.split(":").trim()[18] -split "source")[0].trim()}}

Open in new window

0
 
LVL 17

Accepted Solution

by:
Learnctx earned 2000 total points
ID: 40436309
This is a function I wrote for parsing logon events. Defaults to the localhost if a the ComputerName parameter is not set. Usage is simple:

$results = GetLogonEvents
Or
GetLogonEvents | Export-Csv -NoType whatever.csv
Or
GetLogonEvents -ComputerName ComputerNameHere

Function GetLogonEvents
{
	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults
}

Open in new window

0
 

Author Comment

by:nav2567
ID: 40439110
Learnctx, can I create a ps1 file and paste everything below and run it?  

GetLogonEvents -ComputerName SERVER_A

Function GetLogonEvents
{
      param (
            [string]$ComputerName = "localhost"
      )
      $ArrResults = New-Object System.Collections.ArrayList
      $regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
      Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
      $Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
      $EventsTotal = $Events.Count
      $count = 0
      Foreach ($Event in $Events)
      {
            $count++
            $percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
            Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
            $objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
            $objResult.Time = $Event.TimeCreated
            [void]($Event.Message -match $regex)
            $objResult.user = $matches.user
            $objResult.user_domain = $matches.user_domain
            $objResult.session_id = $matches.session_id
            $objResult.msad_action = $matches.msad_action
            $objResult.workstation_name = $matches.workstation_name
            $objResult.source_network_address = $matches.source_network_address
            $objResult.source_port = $matches.source_port
            [void]$ArrResults.Add($objResult)
      }
      return $ArrResults
}


JoeKlimis, I copy yours into a notepad and put everything in one line and run it.  That doesnt work.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40443741
OK yeah I have written it as a function to be called. You can convert it over to a script by removing the function sections. Save it as GetEventLog.ps1 or whichever name suits best.

GetEventLog.ps1 -ComputerName Computer

	param (
		[string]$ComputerName = "localhost"
	)
	$ArrResults = New-Object System.Collections.ArrayList
	$regex = "(?ms)An account was (?<msad_action>.*?)[:\.]\s*\n.*New Logon:\s*\n.*?Account Name:\s*(?<user>.*?)\s*\n.*?Account Domain:\s*(?<user_domain>.*?)\s*\n.*Logon ID:\s*(?<session_id>.*?)\s*\n.*Network Information:\s\n.*?Workstation Name:\s*(?<workstation_name>.*?)\s*\n.*Source Network Address:\s*(?<source_network_address>.*?)\s*\n.*?Source Port:\s*(?<source_port>.*?)\s*\n.*"
	Write-Progress -Activity "Log Parser" -Status "Waiting" -CurrentOperation "Searching for events"
	$Events = Get-WinEvent -ComputerName $ComputerName -FilterHashtable @{logname="security";id=4624}
	$EventsTotal = $Events.Count
	$count = 0
	Foreach ($Event in $Events)
	{
		$count++
		$percent = "{0:N0}" -f $(($count/$EventsTotal)*100)
		Write-Progress -Activity "Log Parser" -Status "$percent% Complete" -CurrentOperation "Parsing events" -PercentComplete $percent
		$objResult = "" | Select time, user, user_domain, session_id, msad_action, workstation_name, source_network_address, source_port
		$objResult.Time = $Event.TimeCreated
		[void]($Event.Message -match $regex)
		$objResult.user = $matches.user
		$objResult.user_domain = $matches.user_domain
		$objResult.session_id = $matches.session_id
		$objResult.msad_action = $matches.msad_action
		$objResult.workstation_name = $matches.workstation_name
		$objResult.source_network_address = $matches.source_network_address
		$objResult.source_port = $matches.source_port
		[void]$ArrResults.Add($objResult)
	}
	return $ArrResults

Open in new window

0
 

Author Comment

by:nav2567
ID: 40444072
I create a ps1 file using the above and call it from a powershell window: GetEventLog.ps1 -ComputerName server1 and see the following error:

The term 'geteventlog.ps1' is not recognized as the name of a cmdlet, function, script file, or operable program. Che
ck the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:18
+ geteventlog.ps1 <<<<  -ComputerName server1
    + CategoryInfo          : ObjectNotFound: (geteventlog.ps1:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException


Suggestion [3,General]: The command geteventlog.ps1 was not found, but does exist in the current location. Windows Pow
erShell doesn't load commands from the current location by default. If you trust this command, instead type ".\checklogi
n_v2.ps1". See "get-help about_Command_Precedence" for more details.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40444195
Ah yes Powershell won't execute a script from the current directory. So you either have to provide the full path (example below)...

c:\temp\scripts\scriptname.ps1

Open in new window


Or prefix the script with a .\ to tell Powershell to execute from the current directory (example below).

cd c:\temp\scripts
.\scriptname.ps1

Open in new window

0

Featured Post

Office 365 Training for Admins - 7 Day Trial

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Suggested Courses

764 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question