Mohammed Hamada
asked on
Create a PowerShell script that would get the last 30 days history logon of Domain Admin member
Dear All,
I would like to write a Power Shell script that would do the following:
- If the user is member of (Domain admins) get me the last 30 days history logon of this user in any Domain joined computer.
I created something now but it still lacks a lot as it reads the security events on the Domain controller and brings the users,time and matches them with the Domain admin group as in the attached screenshot
I would appreciate if someone can help me evolve this script into something useful
I would like to write a Power Shell script that would do the following:
- If the user is member of (Domain admins) get me the last 30 days history logon of this user in any Domain joined computer.
I created something now but it still lacks a lot as it reads the security events on the Domain controller and brings the users,time and matches them with the Domain admin group as in the attached screenshot
I would appreciate if someone can help me evolve this script into something useful
$Rusers = Get-WinEvent -Computer dc02 -FilterHashtable @{Logname='Security';ID=4672} -MaxEvents 50 |
` select @{N='User';E={$_.Properties[1].Value}},TimeCreated
$DAUsers = Get-ADGroupMember -Identity "Domain Admins"
Foreach ($DAUser in $DAUsers){
$DomainUser = $DAUser.SamAccountName
foreach ($Ruser in $Rusers){
$RAUser = $Ruser.User
If ($RAUser -match $DomainUser){
Write-Host $Ruser is domain admin }
}
}
Screenshot_1.jpg
ASKER
Hi Alex,
Yes I think it might be simpler than I am trying to do it. Is it possible to get the source server of where the user logged from?
An example:
Assuming Domain admin User 1 is being utilized by SQL, Sccm or Scom service and tries to authenticate over the DC.
Is it possible to add the source to the file?
Thank you
Yes I think it might be simpler than I am trying to do it. Is it possible to get the source server of where the user logged from?
An example:
Assuming Domain admin User 1 is being utilized by SQL, Sccm or Scom service and tries to authenticate over the DC.
Is it possible to add the source to the file?
Thank you
that's in the
%computername%
So you build this as a BAT file and then deploy it that way, so drop it into netlogon.
Regards
Alex
%computername%
So you build this as a BAT file and then deploy it that way, so drop it into netlogon.
Regards
Alex
For me it shows up like this
03/12/2019,14:24:55.64,lap top005666, Alex.green ,Console,\ \Domaincon troller
03/12/2019,14:24:55.64,lap
Assuming Domain admin User 1 is being utilized by SQL, Sccm or Scom service and tries to authenticate over the DC.
Is it possible to add the source to the file?
Is this for service accounts???
ASKER
Yes it is, I created a script that invokes a command to find all non-local system services (just domain accounts) and prints them to a file. But need to also know if those users are authenticating or running against the DC.
It's for auditing reasons and to check where and from which server those accounts are running in..etc
It's for auditing reasons and to check where and from which server those accounts are running in..etc
Yeah service accounts won't work, they won't run as a standard logon which means they won't invoke the script in the first place.
If you've confirmed they are running as a service, they will authenticate to the DC. Your better option would be to just scan your infrastructure of all services and their respective domain account which you've done. If it's a service that's running then it's authenticating.
Regards
Alex
If you've confirmed they are running as a service, they will authenticate to the DC. Your better option would be to just scan your infrastructure of all services and their respective domain account which you've done. If it's a service that's running then it's authenticating.
Regards
Alex
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thank you
Then have something like
Log on
echo %date%,%time%,%computernam
Log off
echo %date%,%time%,%computernam
Then stipulate where you want the file dumped.
Regards
Alex