0

I would like to use powershell to script displaying and editing audit rules to Active Directory objects instead of operating through the GUI as described below: From Active Directory Users and Computers, enable "Advanced Features" in the "View" menu, Select the "Domain Controllers OU" in the left pane Right Click the "Domain Controllers OU" object and select "Properties" Select the "Security" tab Select the "Advanced" button and then the "Auditing" tab

Here is what I have so far. First get the distinguishedName of the OU:

import activedirectory
set-location ad:
dir

Plug the correct distinguishedName from the dir output above into Get-Acl:

$acl = Get-Acl -Path "DC=something,DC=somethingElse"

The GetSecurityDescriptorSddlForm method of the $acl object seems related, but does not give human-readable output. Next I tried:

$domain = Get-AdDomain -Server "serverName"
$domainSID = $domain.DomainSID
$acl.GetAuditRules(1,1,$domainSID)

But this gives an error: Cannot convert argument targetType with value "..." for GetAuditRules to type "System.Type": Cannot convert the "..." value of type System.Security.Principal.SecurityIdentifier to type "System.Type"

The documentation for GetAuditRules seems to say that it will accept a SecurityIdentifier for the third parameter, which is what I thought I fed the GetAuditRules method. https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonobjectsecurity.getauditrules?view=dotnet-plat-ext-3.1

Also, the post here seems related, but I don't understand how to select the correct constructor method for creating an ActiveDirectoryAuditRule, and how to collect the needed parameters, such as GUID https://social.technet.microsoft.com/Forums/en-US/70881826-6189-48c0-8ee7-0d79aa18f085/powershell-to-set-audit-flags-on-ou?forum=ITCG

Any help is appreciated. Thanks!

1 Answer 1

0

this one is for a registry but seems very similar. try the "-audit" switch in your get-acl.

https://stackoverflow.com/questions/13509667/how-to-get-audit-rule-in-acl-object-with-getauditrules-on-registry-key-in-powe

$acl = get-acl -path $pathtoOU -Audit

$acl.getauditrules($true,$true, [System.Security.Principal.NTAccount] )

1
  • Adding the -Audit switch is what I needed. Also, I just learned that it wants the object type to be passed in as a parameter, not an actual object of that type. Thanks! Aug 31, 2020 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .