I would like to use powershell to script displaying and editing audit rules to Active Directory objects instead of operating through the GUI as described below: From Active Directory Users and Computers, enable "Advanced Features" in the "View" menu, Select the "Domain Controllers OU" in the left pane Right Click the "Domain Controllers OU" object and select "Properties" Select the "Security" tab Select the "Advanced" button and then the "Auditing" tab
Here is what I have so far. First get the distinguishedName of the OU:
import activedirectory
set-location ad:
dir
Plug the correct distinguishedName from the dir output above into Get-Acl:
$acl = Get-Acl -Path "DC=something,DC=somethingElse"
The GetSecurityDescriptorSddlForm method of the $acl object seems related, but does not give human-readable output. Next I tried:
$domain = Get-AdDomain -Server "serverName"
$domainSID = $domain.DomainSID
$acl.GetAuditRules(1,1,$domainSID)
But this gives an error: Cannot convert argument targetType with value "..." for GetAuditRules to type "System.Type": Cannot convert the "..." value of type System.Security.Principal.SecurityIdentifier to type "System.Type"
The documentation for GetAuditRules seems to say that it will accept a SecurityIdentifier for the third parameter, which is what I thought I fed the GetAuditRules method. https://docs.microsoft.com/en-us/dotnet/api/system.security.accesscontrol.commonobjectsecurity.getauditrules?view=dotnet-plat-ext-3.1
Also, the post here seems related, but I don't understand how to select the correct constructor method for creating an ActiveDirectoryAuditRule, and how to collect the needed parameters, such as GUID https://social.technet.microsoft.com/Forums/en-US/70881826-6189-48c0-8ee7-0d79aa18f085/powershell-to-set-audit-flags-on-ou?forum=ITCG
Any help is appreciated. Thanks!