2

I am trying to set up a monitoring vbscript for active directory. I need to export to a file all users that were modified. This script will run every 10 minutes and export all modified users (account modified, date modified, who modified). The same thing for group modifications (different output file).

I dont mind using vbscript, csvde or dget, dsquery or a batch to get those information's. Anything that I can set up a schedule task is ok.

Improve this question

4 Answers 4

Reset to default
4

You can do most of this with powershell and LDIF - the snippet below for example will produce a file called ad.txt that has a list of user objects changed or added in the last ten minutes 

$DateString = (Get-Date).AddMinutes(-10).ToString("u") -Replace "-|:|\s"
$DateString = $DateString -Replace "Z", ".0Z"
$LdapFilter = """" + "(&(|(whenChanged>=" + $DateString + ")(whenCreated>=" + $DateString + "))(objectClass=user))" + """" 
$lCmd = "ldifde -f ad.txt -r " + $LdapFilter + " -l ""dn,whenCreated,whenChanged"""
Invoke-Expression $lCmd
Improve this answer
5
  • Thanks Phil, unfortunately I can't have access to powershell (dont ask why). Can I use vbscript to do this?
    – name
    Dec 5, 2011 at 13:17
  • You probably can but I'm not a VB expert - a quick google reveals it has a DateAdd function that will do a similar thing to the AddMinutes bit above
    – Phil
    Dec 5, 2011 at 13:36
  • please help. any vbcode will do. I just googled for what you've told me like 6 hours
    – name
    Dec 5, 2011 at 13:37
  • @name We're not here to do your job for you...
    – MDMarra
    Dec 5, 2011 at 14:29
  • @MarkM i know but I could not get that to work. and the powershell code is not working also... :(
    – name
    Dec 5, 2011 at 14:42
3

Okay, I found this on TechNet:

Monitor Groups in an OU in AD for changes on Group Membership

This script runs on a scheduled task to monitor and alert for changes in Active Directory. Any changes to group membership will cause an alert email to be created with the changes included.

The script saves the current members of the Groups in an XML document and then compares the live directory every X minutes. The script will not detect changes within the time period the scheduled task is run i.e. if a member was added and removed in between the task running no changes will be detected.

I run the script every 15 minutes and find it highly effective.

It detects changes to User, Computer or Groups accounts.

Thanks Ben Wilkinson!

Improve this answer
1

This sounds like it would be a simple request, but it quickly becomes boiling the ocean.

While there are commercial products that do this (and the reasons will become apparent), basically you need to run your query (all users where date modified is < 10 minutes ago). Unfortunately, this won't tell you what has changed. I don't think it will tell you who has made the change, either (You may be able to put it together with Event Viewer AD Logs.) (I'm not positive, but this may also pick up password changes.)

What you would also need to do to complete that picture, you basically need to export every user and all of their properties, and keep time-stamped records of them.

At this point, I'd like to point out that you're making multiple separate databases that contain (a subset) of the contents of Active Directory.

After you have your list of users-changed, you then have to do a diff on the object's current and previous state, and present that data to whomever cares.

Then, at some point, you're going to have to clean things up, because keeping multiple copies of your AD objects around is going to start taking up space... Once the report of the changes is out, you only really need to keep the current and immediately previous record.

Depending on the number of users in your environment, the number of people who can make changes (admins, helpdesk, etc), and the frequency of those changes, this could very easily get unmanageable fast.

Honestly, Unless you're trying to quickly discover wrongdoing, 10 minutes is probably overkill; I would do no more than an hour, and probably a daily record.

But, here are some places to get you started:

Improve this answer
1
  • well i do not want to get to databases, paid solutions and etc. all I've got now is: CSVDE -f -%date:~-10,2%_%date:~-7,2%_%date:~-4,4%.csv -d "OU=test,OU=test,OU=test,DC=test,DC=test" -r "(&(objectClass=user)(whenCreated>=%date:~-4,4%%date:~-10,2%%date:~-7,2%000000.0Z)(whenCreated<=%date:~-4,4%%date:~-10,2%%date:~-7,2%235959.0Z))" -l "employeeID, sn, givenName, sAMAccountName"
    – name
    Dec 5, 2011 at 12:58
0

I might be late to the party but I've written a script to monitor user / group changes Monitor group and user changes with power shell. The usual approach by most of scripts I was able to find was to monitor changes that happen on the AD level by comparing before and after changes. My approach does this by going thru Events stored on AD controllers. The big benefit of that is that it tells you exactly who does the change and when.

This PowerShell script can generate report according to your defined parameters and monitor for changes that happen on users and groups in Active Directory. It can tell you:

  • When and who changed the group membership of any group within your Active Directory Domain
  • When and who changed the user data including Password, UserPrincipalName, SamAccountName, and so on…
  • When and who changed passwords When and who locked out account and where did it happen

I'm sorry that I'm not pasting code here but there's just too many moving parts and it's still work in progress. Hopefully the link will be enough and it will help someone.

Report example that you receive daily, monthly or quarterly.

Report Example

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .