Cuando el Directorio Activo es administrado por un grupo de personas, y necesitamos saber quien ha realizado o realiza alguna tarea concreta, este script nos ayuda a mantener un registro de quien/quienes deshabilitan objetos usuarios en el Directorio Activo de nuestro dominio.
Consideraciones para la ejecución del script:
- Habilitar auditoria en los controladores de dominio
- El evento que registra la eliminación de usuarios es el 4725 de la parte de seguridad del visor de eventos.
- Ejecutar el script en los controladores de dominio si no se tiene habilitado WMI en dichos DC.
- El script registra todos los usuarios que se han habilitado en el día anterior.
- El script registra el objeto usuario que se ha deshabilitado, la fecha en la que se ha deshabilitado y la cuenta administrativa que deshabilita dicha cuenta de usuario.
Script:
param( [switch]$LastLogonOnly,[switch]$OuOnly)
############## Find EventID 4725 with user's requesting Kerberos TGT, skipping Exchange Health Mailbox request and extracting Users/Client names,IP Addresses ####
Set-ExecutionPolicy Unrestricted -Force
#Create directorys if not exists
New-Item -ItemType Directory -Force -Path "C:\scripts" | Out-Null
New-Item -ItemType Directory -Force -Path "C:\scripts\cuentasUsuariosDeshabilitadas" | Out-Null
Remove-Item "C:\scripts\cuentasUsuariosDeshabilitadas\cuentasUsuariosDeshabilitados_$((Get-Date).AddDays(-1).ToString('dd-MM-yyyy')).csv" -Force -ErrorAction SilentlyContinue
$Domain = (Get-WmiObject Win32_Computersystem).domain
$read_log={
Param ($OuOnly,$Domain) ## Define parameter to pass maxevent to scripblock
$EventInfo=Get-WinEvent -FilterHashTable @{LogName="Security"; ID=4725} | where {$_.Message -notmatch "SM_" } | where { $_.Message -notmatch "\$" } |
select Message, TimeCreated , MachineName
$EventInfo | foreach {
############# Find the User account in AD and if not found, throw and exception ###########
$Full_User_Property=0
Try ## Need Try statement to test and surpress error
{
$Full_User_Property = (Get-AdUser $_.usuario -Properties *)
$_."Localizacion" = $Full_User_Property.CanonicalName.TrimStart($Domain).SubString(1)
}
catch
{ } ## The $_."User Location" is not passed to catch statement thus needing another below statement to set value"
Return $_
}
}
########### Job starts to query replica domain controllers #############
$result=@()
$RemoteJob=@()
#Importa modulo de AD
Import-Module ActiveDirectory
$date= ((Get-Date).AddDays(-1))
$dateString = $date.ToLongDateString()
## Make array of remote jobs
$DomainControllers = (Get-ADDomainController -Filter { isGlobalCatalog -eq $true -or isGlobalCatalog -eq $false}).Name
############### Start the Local Job and Remote Job to find the event id ################
$LocalJobExists=0
If ($DomainControllers -contains $(hostname)) ## Check if the computer running the script is Domain Controller itself
{
$LocalJob = Start-Job -scriptblock $read_log -ArgumentList $OuOnly,$Domain;$LocalJobExists=1 ## If so, start job to query local domain controller
}
$DomainControllers | where {$_ -ne $(hostname)} | foreach {
## Start remote jobs on each other domain controllers
$RemoteJob+= Invoke-Command -ComputerName $_ -ScriptBlock $read_log -ArgumentList $OuOnly,$Domain -AsJob -ErrorAction SilentlyContinue
}
If ($LocalJobExists)
{
$result = $LocalJob | Wait-Job | Receive-Job; Remove-Job $LocalJob ## If the computer running the script is not a domain controller(may be RSAT installed), then all jobs will be remote jobs
}
$resultDomainController=@()
$RemoteJob | foreach {
$resultDomainController= $resultDomainController + $_ | Wait-Job -ErrorAction SilentlyContinue -Force | Receive-Job -ErrorAction SilentlyContinue;
Remove-Job $_ -ErrorAction SilentlyContinue -Force }
## Wait and Receive remote jobs on each remote DCs and add to Local job result
forEach ($a in $result){
if ($a.TimeCreated.ToLongDateString() -eq $dateString) {
#Manipulate manually message
$message = $a.message
$message | Out-File -FilePath "C:\scripts\message.txt"
$user = Select-String C:\scripts\message.txt -pattern "Nombre de cuenta:"
$nameAdmin = $user[0].Line.Split(":")
$nameUser = $user[1].Line.Split(":")
Remove-Item C:\scripts\message.txt -Force -ErrorAction SilentlyContinue
If ($LastLogonOnly)
{
$(
[PSCustomObject]@{UsuarioDeshabilitado=$nameUser[1].Trim();Administrador=$nameAdmin[1].Trim();FechayHora=$a.TimeCreated.ToShortDateString() +","+ $a.TimeCreated.ToShortTimeString();NombreMaquina=$a.MachineName}
) | Export-Csv "C:\scripts\cuentasUsuariosDeshabilitadas\cuentasUsuariosDeshabilitados_$((Get-Date).AddDays(-1).ToString('dd-MM-yyyy')).csv" -NoTypeInformation -Append
}
else
{
$(
[PSCustomObject]@{UsuarioDeshabilitado=$nameUser[1].Trim();Administrador=$nameAdmin[1].Trim();FechayHora=$a.TimeCreated.ToShortDateString() +","+ $a.TimeCreated.ToShortTimeString();NombreMaquina=$a.MachineName}
) | Export-Csv "C:\scripts\cuentasUsuariosDeshabilitadas\cuentasUsuariosDeshabilitados_$((Get-Date).AddDays(-1).ToString('dd-MM-yyyy')).csv" -NoTypeInformation -Append
}
}
}
forEach ($a in $resultDomainController){
if ($a.TimeCreated.ToLongDateString() -eq $dateString) {
#Manipulate manually message
$message = $a.message
$message | Out-File -FilePath "C:\scripts\message.txt"
$user = Select-String C:\scripts\message.txt -pattern "Nombre de cuenta:"
$nameAdmin = $user[0].Line.Split(":")
$nameUser = $user[1].Line.Split(":")
Remove-Item C:\scripts\message.txt -Force -ErrorAction SilentlyContinue
If ($LastLogonOnly)
{
$(
[PSCustomObject]@{UsuarioDeshabilitado=$nameUser[1].Trim();Administrador=$nameAdmin[1].Trim();FechayHora=$a.TimeCreated.ToShortDateString() +","+ $a.TimeCreated.ToShortTimeString();NombreMaquina=$a.MachineName}
) | Export-Csv "C:\scripts\cuentasUsuariosDeshabilitadas\cuentasUsuariosDeshabilitados_$((Get-Date).AddDays(-1).ToString('dd-MM-yyyy')).csv" -NoTypeInformation -Append
}
else
{
$(
[PSCustomObject]@{UsuarioDeshabilitado=$nameUser[1].Trim();Administrador=$nameAdmin[1].Trim();FechayHora=$a.TimeCreated.ToShortDateString() +","+ $a.TimeCreated.ToShortTimeString();NombreMaquina=$a.MachineName}
) | Export-Csv "C:\scripts\cuentasUsuariosDeshabilitadas\cuentasUsuariosDeshabilitados_$((Get-Date).AddDays(-1).ToString('dd-MM-yyyy')).csv" -NoTypeInformation -Append
}
}
}