Support
 
Phone Get Quote
 
Support
 
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

How to audit Active Directory changes using PowerShell?

In a large Active Directory environment with many objects there'd be thousands of operations taking place day in day out. It becomes important to keep track of these changes, their source, their effect and the users performing them.

The following is a comparison between the process of auditing Active Directory changes with Windows PowerShell and ADAudit.

Windows PowerShell

Steps to track Active Directory changes:

  • By using the Get-ADObject PowerShell command, we can see all the changes that have been taking place throughout Active Directory.
    $ThisDate = [Datetime]"22/04/2020" Get-ADObject -Filter "WhenChanged" -GT $ThisDate | Export-CSV C:\Folder\ADchanges.CSV -NoTypeInformation
     Copied
    Click to copy entire script
  • The first command is a variable that stores the date. The second command looks for all the changes that have been made in Active Directory greater than the date specified in the $ThisDate variable. The output is stored in the C:\Folder\ADChanges.
  • The filter can be replaced with "WhenCreated" to see the list of objects recently created in AD.
  • The report will be exported in the format specified in the script. To obtain the report in a different format, modify the script.

ADAudit Plus

To obtain Active Directory changes report,

  • Log in to the ADAudit Plus web console.
  • Click on the Reports Tab > Account Management.
  • Select the Domain from the drop down.
  • Under Account Management, you will find the below mentioned reports.
    • All AD Changes
    • All AD Changes By User
    • All AD Changes on DCs
    • User Management
    • Group Management
    • Computer Management
    • OU Management
    • GPO Management
    • Administrative User Actions
  • Select Export as to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).
powershell-audit-active-directory-changes-1

Why is ADAudit Plus the better solution you should consider?

  • Comprehensive dashboard to compare and correlate reports.
  • Provision to export reports in the desired format with a single click.
  • Multiple filters to help retrieve the necessary information from an extensive database.
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  •  
  • By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
  •  
  • Thanks!
  • Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Related Resources

ADAudit Plus Trusted By