Support
 
Phone Get Quote
 
Support
 
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

How to get Active Directory Reports using PowerShell?

In Active Directory, every event has an ID. Using the PowerShell Get-WinEvent cmdlet we can find auditing records. Alternatively, you can use a comprehensive AD auditing solution like ADAudit Plus that will make things simpler for you.

This article compares the method of getting AD audit reports using PowerShell and ADAudit Plus.

PowerShell

Steps to get auditing records using PowerShell:

  • Using the Get-WinEvent cmdlet, basic security logs can be audited. A particular event can be audited by using the event ID.
    Get-WinEvent -Computer dc1 -FilterHashtable @{LogName="Security";ID=4720} | fl 
  • Additional basic details such as time and username can be retrieved using the below script.
    Get-WinEvent -Computer dc1 -FilterHashtable @{LogName="Security";ID=4720} | Select TimeCreated,@{n="WHO";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserName"} |%{$_.'#text'}}},@{n="User Account";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SamAccountName"}| %{$_.'#text'}}} |fl
     Copied
    Click to copy entire script

ADAudit Plus

To obtain the report,

Security logs comprise multiple events like, file or AD object modifications, account logon or logoff failures, permission changes.

  • Log in to the ADAudit Plus web console.
  • Go to the Reports tab. All reports concerning Active Directory are readily available. This tab offers you a number of event reports. You can use search filters to find a particular event within the report.
  • Select the report and domain.
  • Select Export As to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).

screenshots:

audit-active-directory-using-powershell-1
audit-active-directory-using-powershell-2
audit-active-directory-using-powershell-3

Why ADAudit Plus is the better solution for you?

  • Comprehensive dashboard so you can compare and correlate reports.
  • ADAudit Plus allows you to export reports in the desired format with a single click easily.
  • Advanced filter options to save you the trouble of creating complex LDAP queries to fetch only the required information.
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  •  
  • By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
  •  
  • Thanks!
  • Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Related Resources

ADAudit Plus Trusted By