Audit basic events in Active Directory with Windows 2012.

I want to share a way to audit events in Active Directory with domain controllers on Windows 2012 and younger.
For servers with OS Windows 2012 and younger, a new method of collecting events "ForwardedEvents" appeared. First, configure the collection of events on the dedicated server:
1. Create the policy "AuditFrw" and apply to the OU "Domain Controllers"
Computer Configuration - Administrative Templates - Windows Components - Event Forwarding - Server=http://scr-server.blogspot.com:5985/wsman/SubscriptionManager/WEC,Refresh=120

Computer Configuration - Administrative Templates - Windows Components - Windows Remote Management (WinRM) - WinRMService - Allow remote server managment through WinRM - 1.1.1.0-1.1.1.50

Computer Configuration - Preferences - Control Panel Settings - Services - Service:WinRM - Start/Automatic(Delayed Start)

2. On the audit server scr-server.blogspot.com we create a subscription
Event Viewer - Subscriptions - Create Subscription
- Name:Base-Audit-AD
- Type: Source computer initiated
- Computers: "Domain Controllers"
- Events: 4728,4732,4756,4729,4733,4757,4720,4726,4727,4731,4754,4730,4734,4758,4741,4725,4740

3. Create a task on a schedule, for example: 7 am, every day, repeat every 12:00
and specify the script

Download Script

$hf = "D:\Scripts\Audit"

cd $hf

$s_date = (Get-date).AddDays(-0.5)

function ResolveSID ($sid) {

    $objSID = New-Object System.Security.Principal.SecurityIdentifier($sid)

    $objUser = $objSID.Translate([System.Security.Principal.NTAccount])

    Return $objUser.Value

}

#add to gr

$evs_add_to_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4728,4732,4756} -ea 0

if ($evs_add_to_gr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\AddUserToGorup\AddUserToGorup_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,Group,NewMember,AddedBy"

    $evs_add_to_gr = $evs_add_to_gr | sort TimeCreated | select TimeCreated,

    @{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="NewMember";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "MemberSid"} | %{$_.’#text’}}},

    @{n="AddedBy";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_add_to_gr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.Group)

        $e_nm = ResolveSID($e.NewMember)

        $e_ab = ResolveSID($e.AddedBy)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_nm,$e_ab"

    }

}

#del from gr

$evs_del_from_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4729,4733,4757} -ea 0

if($evs_del_from_gr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\DelUserFromGroup\DelUserFromGroup_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,Group,DelMember,DelBy"

    $evs_del_from_gr = $evs_del_from_gr | sort TimeCreated | select TimeCreated,

    @{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="DelMember";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "MemberSid"} | %{$_.’#text’}}},

    @{n="DelBy";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_del_from_gr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.Group)

        $e_nm = ResolveSID($e.DelMember)

        $e_ab = ResolveSID($e.DelBy)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_nm,$e_ab"

    }

}

#new gr

$evs_new_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4727,4731,4754} -ea 0

if ($evs_new_gr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\CreateGroup\CreateGroup_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,GroupName,AdminLogin"

    $evs_new_gr = $evs_new_gr | sort TimeCreated | select TimeCreated,

    @{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="GroupName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

    @{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_new_gr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.Group)

        if (!$e_gr) {$e_gr = $e.GroupName}

        $e_ab = ResolveSID($e.AdminLogin)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

    }

}

#del gr

$evs_del_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4730,4734,4758} -ea 0

if ($evs_del_gr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\DelGroup\DelGroup_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,GroupName,AdminLogin"

    $evs_del_gr = $evs_del_gr | sort TimeCreated | select TimeCreated,

    @{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="GroupName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

    @{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_del_gr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.Group)

        if (!$e_gr) {$e_gr = $e.GroupName}

        $e_ab = ResolveSID($e.AdminLogin)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

    }

}

#new usr

$evs_new_usr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4720} -ea 0

if ($evs_new_usr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\CreateUser\CreateUser_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,UserName,AdminLogin"

    $evs_new_usr = $evs_new_usr | sort TimeCreated | select TimeCreated,

    @{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

    @{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_new_usr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.User)

        if (!$e_gr) {$e_gr = $e.UserName}

        $e_ab = ResolveSID($e.AdminLogin)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

    }

}

#del usr

$evs_del_usr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4726} -ea 0

if ($evs_del_usr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\DelUser\DelUser_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,UserName,AdminLogin"

    $evs_del_usr = $evs_del_usr | sort TimeCreated | select TimeCreated,

    @{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

    @{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_del_usr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.User)

        if (!$e_gr) {$e_gr = $e.UserName}

        $e_ab = ResolveSID($e.AdminLogin)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

    }

}

#dis usr

$evs_dis_usr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4725} -ea 0

if ($evs_dis_usr.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\DisableUser\DisableUser_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,UserName,AdminLogin"

    $evs_dis_usr = $evs_dis_usr | sort TimeCreated | select TimeCreated,

    @{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

    @{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_dis_usr) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.User)

        if (!$e_gr) {$e_gr = $e.UserName}

        $e_ab = ResolveSID($e.AdminLogin)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

    }

}

#new pc

$evs_new_pc = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4741} -ea 0

if ($evs_new_pc.count -gt 0) {

    $LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

    $LogFile = ".\Logs\CreatePC\CreatePC_" + $LogTime + ".csv"

    add-content -path $LogFile -value "TimeCreated,PCName,AdminLogin"

    $evs_new_pc = $evs_new_pc | sort TimeCreated | select TimeCreated,

    @{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

    @{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

    @{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

    foreach ($e in $evs_new_pc) {

        $e_gr = $e_nm = $e_ab = @()

        $e_gr = ResolveSID($e.User)

        if (!$e_gr) {$e_gr = $e.UserName}

        $e_ab = ResolveSID($e.AdminLogin)

        add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

    }

}

Domain trust over NAT

To create a trust between domains, for example,

blogspot.com, 172.16.0.0/24, nat 10.0.0.0/24 (NS dc01=10.0.0.5, dc02=10.0.0.6)
contoso.com, 192.168.0.0/24, nat 10.0.1.0/24 (NS dc01=10.0.1.5, dc02=10.0.1.6)

you can create a false-DNS server. On false-DNS server create two zones: blogspot.com, contoso.com. On DNS-servers domains blogspot.com, contoso.com create conditional forwarders to false-DNS server.
On false-DNS server:
blogspot.com
Host A - nat IP 10.0.0.5, 10.0.0.6
Host A - dc01 - 10.0.0.5, dc02 - 10.0.0.6
NS - nat IP 10.0.0.5, 10.0.0.6
SRV(_kerberos) - Default-First-Site-Name._sites.dc._msdcs.blogspot.com - dc01.blogspot.com.
SRV(_kerberos) - Default-First-Site-Name._sites.dc._msdcs.blogspot.com - dc02.blogspot.com.
SRV(_ldap) - Default-First-Site-Name._sites.dc._msdcs.blogspot.com - dc01.blogspot.com.
SRV(_ldap) - Default-First-Site-Name._sites.dc._msdcs.blogspot.com - dc02.blogspot.com.
SRV(_ldap) - pdc._msdcs.blogspot.com - dc01.blogspot.com.

contoso.com
analogically

Then create a trust in the usual way.

How to Migrate Windows User Profile to New Account. User Profile Migration Script.

In this article, I share the script with which you can quickly migrate user profile. The script assigns the rights to the profile folder and registry files, and then change the path to the profile for the new user. This script free and was preferred (for me) than a means "User State Migration Tool".

Example usage:
We need to migrate user "contoso\i-evgeny" to domain "blogspot.com"
1. Create user "blogspot\i-evgeny"
2. Join PC to new domain "blogspot.com", reboot
can remotely with powershell:

Add-Computer -ComputerName PC.contoso.com -DomainName blogspot.com -newname PC-blog -PassThru -Force -restart

3. Logon to PC-blog with user "blogspot\i-evgeny", reboot
4. Logon to PC-blog with Administrator:
- disable UAC
can with powershell:

New-ItemProperty -Path HKLM:Software\Microsoft\Windows\CurrentVersion\policies\system -Name EnableLUA -PropertyType DWord -Value 0 -Force

- run powershell script ".\ProfileMigrate.ps1 contoso\i-evgeny blogspot\i-evgeny"
- reboot
5. Logon to PC-blog with "blogspot\i-evgeny", check your files, application etc
6. If your have errors when use Certificates additional reassign rights to
HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates
%userprofile%\Application Data\Microsoft\SystemCertificates

"Download .\ProfileMigrate.ps1":

[CmdletBinding()]

Param (

  [Parameter(Mandatory=$True,Position=0)]

  [string]$U_S,

  

  [Parameter(Position=1)]

  [string]$U_D

)

if ($U_S -and $U_D) {

    write-host "Usage example: .\ProfileMigrate.ps1 contoso\i-evgeny blogspot\i-evgeny" -fore green

    $objUser = New-Object System.Security.Principal.NTAccount($U_S)

    $strSID = $objUser.Translate([System.Security.Principal.SecurityIdentifier])

    $Profile = Get-ItemProperty "hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$strSID" -Name ProfileImagePath

    $path = $Profile.ProfileImagePath

    $acl= (Get-Item $path).GetAccessControl('Access')

    $inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"

    $propagation = [system.security.accesscontrol.PropagationFlags]"None"

    $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ($U_D,"FullControl",$inherit,$propagation,"Allow")

    $acl.addaccessrule($rule)

    Set-ACL $path $ACL

    reg load hklm\sourceuser $path\NTUSER.DAT

    reg load hklm\sourceuser2 $path\AppData\Local\Microsoft\Windows\UsrClass.dat

    $path = "hklm:\sourceuser"

    $acl= get-acl -path $path

    $inherit = [system.security.accesscontrol.InheritanceFlags]"ContainerInherit, ObjectInherit"

    $propagation = [system.security.accesscontrol.PropagationFlags]"None"

    $rule=new-object system.security.accesscontrol.registryaccessrule $U_D,"FullControl",$inherit,$propagation,"Allow"

    $acl.addaccessrule($rule)

    $acl|set-acl

    $path2 = "hklm:\sourceuser2"

    $acl2 = get-acl -path $path2

    $acl2.addaccessrule($rule)

    $acl2|set-acl

    do {

    Start-Sleep -s 10

    reg unload hklm\sourceuser

    } while (test-path $path)

    do {

    Start-Sleep -s 10

    reg unload hklm\sourceuser2

    } while (test-path $path2)

    $objUser = New-Object System.Security.Principal.NTAccount($U_S)

    $strSID = $objUser.Translate([System.Security.Principal.SecurityIdentifier])

    $Profile = Get-ItemProperty "hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$strSID" -Name ProfileImagePath

    $Profile.ProfileImagePath

    $objUser2 = New-Object System.Security.Principal.NTAccount($U_D)

    $strSID2 = $objUser2.Translate([System.Security.Principal.SecurityIdentifier])

    $Profile2 = Get-ItemProperty "hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$strSID2" -Name ProfileImagePath

    $Profile2.ProfileImagePath

    Set-ItemProperty "hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$strSID2" -name ProfileImagePath -Value $Profile.ProfileImagePath

    Remove-ItemProperty "hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\$strSID" -name ProfileImagePath

} else {

    write-host "Usage example: .\ProfileMigrate.ps1 contoso\i-evgeny blogspot\i-evgeny" -fore green

}