We help IT Professionals succeed at work.

AD - Domain Admins Group - Track changes

232 Views
Last Modified: 2017-03-27
Is there a way to find out who or when a "service account" or "user account" was added to the "Domain Admins" Security Group?

I need to track who on my dept added an account to it and track down what the need/purpose was...

Thanks
Comment
Watch Question

PowerShell Developer
CERTIFIED EXPERT
Top Expert 2010
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
Shaun VermaakSenior Consultant
CERTIFIED EXPERT
Awarded 2017
Distinguished Expert 2019
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION
Adam BrownCloud Security Consultant
CERTIFIED EXPERT
Top Expert 2010

Commented:
FYI - Shaun's answer requires Server 2012 R2 to work. Previous versions of AD Powershell don't include that cmdlet. You may be able to view the replication metadata in earlier versions, but you'll need a more complex script.

Also, without being able to do that, you would not be able to view privileged account changes without auditing enabled and configured in AD to track directory changes. It's not set up by default, so open ADUC in the Advanced View, right click the group, go to properties, select the Security Tab, go to advanced, and then check the Auditing tab. If nothing is shown there, you can't view auditing data because it isn't being recorded. This is also the case if the auditing logs are not large enough to record data going back far enough.
Shaun VermaakSenior Consultant
CERTIFIED EXPERT
Awarded 2017
Distinguished Expert 2019

Commented:
Just install Powershell v5

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions