/
Get_AD_Users_Logon_History.ps1
156 lines (131 loc) · 7.81 KB
/
Get_AD_Users_Logon_History.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
<#
.SYNOPSIS
Script that will list the logon information of AD users.
.DESCRIPTION
This script will list the AD users logon information with their logged on computers by inspecting the Kerberos TGT Request
Events(EventID 4768) from domain controllers. Not Only User account Name is fetched, but also users OU path and Computer
Accounts are retrieved. You can also list the history of last logged on users. In Environment where Exchange Servers are
used, the exchange servers authentication request for users will also be logged since it also uses EventID (4768) to for
TGT Request. You can also export the result to CSV file format. Powershell version 3.0 is needed to use the script.
You can Define the following parameters to suite your need:
-MaxEvent Specify the number of all (4768) events to search for TGT Requests. Default is 1000.
-LastLogonOnly Display only the history of last logon users.
-OuOnly Do not display the full path of users/computers. Only OU is displayed.
Author: phyoepaing3.142@gmail.com
Country: Myanmar(Burma)
Released Date: 08/29/2016
https://gallery.technet.microsoft.com/Get-All-AD-Users-Logon-9e721a89
Example usage:
.\Get_AD_Users_Logon_History.ps1 -MaxEvent 800 -LastLogonOnly -OuOnly
.EXAMPLE
.\Get_AD_Users_Logon_History.ps1 | Format-Table * -Auto
This command will retrieve AD users logon within default 1000 EventID-4768 events and display the results as table.
.EXAMPLE
.\Get_AD_Users_Logon_History.ps1 -MaxEvent 500 -LastLogonOnly -OuOnly
This command will retrieve AD users logon within 500 EventID-4768 events and show only the last logged users with their
related logged on computers. Only OU name is displayed in results.
.EXAMPLE
.\Get_AD_Users_Logon_History.ps1 | Export-Csv Users_Loggedon_History.csv
This command will retrieve AD users logon within default 1000 EventID-4768 events and export the result to CSV file.
.PARAMETER MaxEvent
This paraemeter will specify the number of EventID-4768 events to look for.
.PARAMETER LastLogonOnly
This paraemeter will display the history of last logged on users in descending order.
.PARAMETER OuOnly
This paraemeter will show only the OU names for users/computers but not the full path.
.LINK
You can find this script and more at: https://www.sysadminplus.blogspot.com/
#>
param( [switch]$LastLogonOnly,[switch]$OuOnly,[int]$MaxEvent=1000)
############## Find EventID 4768 with user's requesting Kerberos TGT, skipping Exchange Health Mailbox request and extracting Users/Client names,IP Addresses ####
$Domain = (Get-WmiObject Win32_Computersystem).domain
$read_log={
Param ($MaxEvent,$OuOnly,$Domain) ## Define parameter to pass maxevent to scripblock
$EventInfo=Get-WinEvent -FilterHashTable @{LogName="Security";ID=4768} -MaxEvents 200000 | select -first $MaxEvent | where {$_.Message -notmatch "SM_" } | where { $_.Message -notmatch "\$" } |
select @{N="Authenticated DC";Exp={$_.MachineName}},
@{N="LoggedOn Time";Exp={$_.TimeCreated}},
@{N="User"; Exp={ $SplitAccountName=(($_.Message -Split "\n") -match "Account Name") -split ':';$SplitAccountName[$SplitAccountName.Length-1].Trim() }},
@{N="User Location";Exp={}}, @{N="Workstation";Exp={}},
@{N="IP Address"; Exp={if((($_.Message -split "\n") -match "Client Address:").Trim() -match "::1" ) {"localhost"}
else { $SplitClientAddress=(($_.Message -Split "\n") -match "Client Address") -split ':'; $splitClientAddress[$splitClientAddress.Length-1].Trim() }}},
@{N="Computer Location";Exp={}}
$EventInfo | foreach {
$IPAddress=$_."Client Address"
if ($_."IP Address" -eq "localhost")
{ $Client_Name=[system.net.dns]::GetHostbyName($env:computername).hostname }
else
{
###### Resolve the PTR record to find AD computer information ################
#$Client_Name=(Resolve-DnsName $_."IP Address").NameHost
if ((Resolve-dnsname $_."IP Address" -Type PTR -TcpOnly -DnsOnly -ErrorAction "SilentlyContinue").Type -eq "PTR")
{
$Client_Name = (Resolve-dnsname $_."IP Address" -Type PTR -TcpOnly -DnsOnly).NameHost
}
else
{ $Client_Name = "NOT FOUND" }
}
## $_."Authenticated DC"=($_."Authenticated DC" -split "."+$Domain)[0] ##Uncomment this line if you want to strip off domain name in "Authenticated DC" list
$user=$_.user
############# Find the User account in AD and if not found, throw and exception ###########
$Full_User_Property=0
Try ## Need Try statement to test and surpress error
{
$Full_User_Property = (Get-AdUser $_.user -Properties *)
$_."User Location" = $Full_User_Property.CanonicalName.TrimStart($Domain).SubString(1)
}
catch
{ } ## The $_."User Location" is not passed to catch statement thus needing another below statement to set value"
If (!$Full_User_Property)
{ $_."User Location"="NOT FOUND" }
$Full_User_Property=0
If($OuOnly -AND ($_."User Location" -ne "NOT FOUND"))
{
$_."User Location"= $_."User Location".Remove($_."User Location".LastIndexOf("/")) ##Trim the last user name part if -OuOnly flag is set
}
$_."Workstation"=($Client_Name -split "."+$Domain)[0] ## remove the domain suffix
########## Find the Computer account in AD and if not found, throw an exception ###########
$Full_Workstation_Property = 0
Try
{
$Full_Workstation_Property = Get-AdComputer $_."Workstation" -Properties *
$_."Computer Location"= $Full_Workstation_Property.CanonicalName.TrimStart($Domain).SubString(1)
}
catch
{ }
########## Here the catch exception does not work in Invoke session so we need to manually set the "NOT FOUND" value ######
If (!$Full_Workstation_Property)
{ $_."Computer Location" = "NOT FOUND"}
$Full_Workstation_Property=0
If ($OuOnly -AND ($_."Computer Location" -ne "NOT FOUND")) ##Trim the last computer part if -OuOnly flag is set
{
$_."Computer Location"=$_."Computer Location".Remove($_."Computer Location".LastIndexOf("/"))
}
Return $_
}
}
########### Job starts to query replica domain controllers #############
$result=@()
$RemoteJob=@() ## Make array of remote jobs
$DomainControllers = (Get-ADDomainController -Filter { isGlobalCatalog -eq $true -or isGlobalCatalog -eq $false}).Name
############### Start the Local Job and Remote Job to find the event id ################
$LocalJobExists=0
If ($DomainControllers -contains $(hostname)) ## Check if the computer running the script is Domain Controller itself
{
$LocalJob = Start-Job -scriptblock $read_log -ArgumentList $MaxEvent,$OuOnly,$Domain;$LocalJobExists=1 ## If so, start job to query local domain controller
}
$DomainControllers | where {$_ -ne $(hostname)} | foreach { ## Start remote jobs on each other domain controllers
$RemoteJob+= Invoke-Command -ComputerName $_ -ScriptBlock $read_log -ArgumentList $MaxEvent,$OuOnly,$Domain -AsJob
}
If ($LocalJobExists)
{
$result = $LocalJob | Wait-Job | Receive-Job; Remove-Job $LocalJob ## If the computer running the script is not a domain controller(may be RSAT installed), then all jobs will be remote jobs
}
$RemoteJob | foreach { $result+=$_ | Wait-Job | Receive-Job ; Remove-Job $_} ## Wait and Receive remote jobs on each remote DCs and add to Local job result
If ($LastLogonOnly)
{
$result | Sort-Object "LoggedOn Time" -Descending | Group-Object User | foreach { $_ | Select -ExpandProperty Group | select * -First 1 -ExcludeProperty PsComputerName,RunSpaceID,PsShowComputerName } ## the Last LoggedOn time of Each User
}
else
{
$result | Sort-Object "LoggedOn Time" -Descending | Select * -ExcludeProperty PsComputerName,RunSpaceID,PsShowComputerName ## Normal Results
}