There are a couple of ways by which you can perform this audit - First the more time-consuming way to get relevant two weeks info:
- From your PDC, export all AD users and computers using windows server csved tool. The corresponding command syntax is
csved -f ADfilename.csv -r objectClass=user
and import the exported csv to excel file with filtering data per columns (Note: when importing set the delimiter to commas and tabs to get the appropriate headings before filtering).
- Likewise import the PDC log file from \Windows\Debug\netsetup.log to a second spreadsheet with the same options as above. From there on, you can do a compare between the two spreadsheets (file1.csv -> file2.csv) and also filter the corresponding data. This can be done very easily with OpenOffice Calc.
Sample Event Data - With Filtering by Date/Time etc.
- When you perform the compare you can check for the corresponding events from the actual server log and the current AD computers and users list. As per your request, focus on NETLOGON events (id 5719) for domain availability/non-availability per computer and NetBIOS events (id 6011) for changes in the domain name per user.
NOTE: This part might take a while since you need to search and filter all corresponding events while comparing and re-merging to find all changes in the NetBIOS name changes.
After doing that, you can use the following programs/scripted samples to do a long-term monitoring of your AD server events and/or corporate computers:
There are two cool things about creating permanent event consumers via script. The first thing is that it can easily be performed remotely. Therefore,, I can target a several machines with the script and create the event consumer on the remote machines. The second cool thing is the fact that permanent event consumers are cool. They monitor for and respond to events without the need for a script to be running. Talk about something cool! I run one script one time, and then my computer will always look for an event and respond to it.
- Use third-party tools such as SolarWinds WMI Monitor to view running event statuses on your Domain Controller. Set monitoring for the following WMI namespace classes:
Win32_NTDomain, Win32_LogonSession, Win32_ComputerSystem
More information on WMI NetBIOS classes is found here.