What is the automated method to check the Administrators, Domain Admins and Enterprise Admins groups weekly for membership additions or deletions?

Hello,

What is the automated method to check the Administrators, Domain Admins and Enterprise Admins groups weekly for membership additions or deletions?

Thank you,
CuriousMAUser
CuriousMAUserAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Will SzymkowskiConnect With a Mentor Senior Solution ArchitectCommented:
ft = format table. ft does not work well with out-put to csv so it need to be modified slightly.

You can do this to a csv use the following command...
import-module activedirectory
Get-ADGroupMember -Identity "domain admins" | select name,samaccountname | export-csv "c:\exportUsers.csv" -noTypeInformation

Open in new window


Will.
0
 
Will SzymkowskiSenior Solution ArchitectCommented:
You can create a powershell script to check the event logs daily to look for specific events related to 4728. This event is logged when a user has been added to a Global Group. You will also need to have Audit Account Management Enabled from the default domain controllers policy.

The email you the event once it logs and entries on any of the domain controllers.
Audit Account Management

This is quite a bit of work rather then just running the below commands

import-module activedirectory
Get-ADGroupMember -Identity "domain admins" | ft name,samaccountname

Open in new window


import-module activedirectory
Get-ADGroupMember -Identity "enterprise admins" | ft name,samaccountname

Open in new window

import-module activedirectory
Get-ADGroupMember -Identity "administrators" | ft name,samaccountname

Open in new window

0
 
CuriousMAUserAuthor Commented:
Thank you. What does 'ft' mean? May I pipe the output from each command to the same csv file?

Get-ADGroupMember -Identity "enterprise admins" | ft name,samaccountname > ADGroupMember.csv

I tried it but it didn't work. Inside the command is a separate pipe symbol | ... ideas?
0
 
CuriousMAUserAuthor Commented:
Thank you. Well done. Mr. Will
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.