My work with products Microsoft Exchange, Lync, TMG, Powershell: Audit

Showing posts with label Audit. Show all posts

Wednesday, July 25, 2018

Audit basic events in Active Directory with Windows 2012.

I want to share a way to audit events in Active Directory with domain controllers on Windows 2012 and younger.
For servers with OS Windows 2012 and younger, a new method of collecting events "ForwardedEvents" appeared. First, configure the collection of events on the dedicated server:
1. Create the policy "AuditFrw" and apply to the OU "Domain Controllers"
Computer Configuration - Administrative Templates - Windows Components - Event Forwarding - Server=http://scr-server.blogspot.com:5985/wsman/SubscriptionManager/WEC,Refresh=120

Computer Configuration - Administrative Templates - Windows Components - Windows Remote Management (WinRM) - WinRMService - Allow remote server managment through WinRM - 1.1.1.0-1.1.1.50

Computer Configuration - Preferences - Control Panel Settings - Services - Service:WinRM - Start/Automatic(Delayed Start)

2. On the audit server scr-server.blogspot.com we create a subscription
Event Viewer - Subscriptions - Create Subscription
- Name:Base-Audit-AD
- Type: Source computer initiated
- Computers: "Domain Controllers"
- Events: 4728,4732,4756,4729,4733,4757,4720,4726,4727,4731,4754,4730,4734,4758,4741,4725,4740

3. Create a task on a schedule, for example: 7 am, every day, repeat every 12:00
and specify the script

Download Script

$hf = "D:\Scripts\Audit"

cd $hf

$s_date = (Get-date).AddDays(-0.5)

function ResolveSID ($sid) {

$objSID = New-Object System.Security.Principal.SecurityIdentifier($sid)

$objUser = $objSID.Translate([System.Security.Principal.NTAccount])

Return $objUser.Value

}

#add to gr

$evs_add_to_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4728,4732,4756} -ea 0

if ($evs_add_to_gr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\AddUserToGorup\AddUserToGorup_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,Group,NewMember,AddedBy"

$evs_add_to_gr = $evs_add_to_gr | sort TimeCreated | select TimeCreated,

@{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="NewMember";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "MemberSid"} | %{$_.’#text’}}},

@{n="AddedBy";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_add_to_gr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.Group)

$e_nm = ResolveSID($e.NewMember)

$e_ab = ResolveSID($e.AddedBy)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_nm,$e_ab"

}

#del from gr

$evs_del_from_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4729,4733,4757} -ea 0

if($evs_del_from_gr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\DelUserFromGroup\DelUserFromGroup_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,Group,DelMember,DelBy"

$evs_del_from_gr = $evs_del_from_gr | sort TimeCreated | select TimeCreated,

@{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="DelMember";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "MemberSid"} | %{$_.’#text’}}},

@{n="DelBy";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_del_from_gr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.Group)

$e_nm = ResolveSID($e.DelMember)

$e_ab = ResolveSID($e.DelBy)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_nm,$e_ab"

}

#new gr

$evs_new_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4727,4731,4754} -ea 0

if ($evs_new_gr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\CreateGroup\CreateGroup_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,GroupName,AdminLogin"

$evs_new_gr = $evs_new_gr | sort TimeCreated | select TimeCreated,

@{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="GroupName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

@{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_new_gr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.Group)

if (!$e_gr) {$e_gr = $e.GroupName}

$e_ab = ResolveSID($e.AdminLogin)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

}

#del gr

$evs_del_gr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4730,4734,4758} -ea 0

if ($evs_del_gr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\DelGroup\DelGroup_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,GroupName,AdminLogin"

$evs_del_gr = $evs_del_gr | sort TimeCreated | select TimeCreated,

@{n="Group";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="GroupName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

@{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_del_gr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.Group)

if (!$e_gr) {$e_gr = $e.GroupName}

$e_ab = ResolveSID($e.AdminLogin)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

}

#new usr

$evs_new_usr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4720} -ea 0

if ($evs_new_usr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\CreateUser\CreateUser_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,UserName,AdminLogin"

$evs_new_usr = $evs_new_usr | sort TimeCreated | select TimeCreated,

@{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

@{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_new_usr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.User)

if (!$e_gr) {$e_gr = $e.UserName}

$e_ab = ResolveSID($e.AdminLogin)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

}

#del usr

$evs_del_usr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4726} -ea 0

if ($evs_del_usr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\DelUser\DelUser_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,UserName,AdminLogin"

$evs_del_usr = $evs_del_usr | sort TimeCreated | select TimeCreated,

@{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

@{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_del_usr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.User)

if (!$e_gr) {$e_gr = $e.UserName}

$e_ab = ResolveSID($e.AdminLogin)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

}

#dis usr

$evs_dis_usr = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4725} -ea 0

if ($evs_dis_usr.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\DisableUser\DisableUser_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,UserName,AdminLogin"

$evs_dis_usr = $evs_dis_usr | sort TimeCreated | select TimeCreated,

@{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

@{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_dis_usr) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.User)

if (!$e_gr) {$e_gr = $e.UserName}

$e_ab = ResolveSID($e.AdminLogin)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

}

#new pc

$evs_new_pc = Get-WinEvent -FilterHashTable @{LogName='ForwardedEvents'; StartTime=$s_date; ID=4741} -ea 0

if ($evs_new_pc.count -gt 0) {

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"

$LogFile = ".\Logs\CreatePC\CreatePC_" + $LogTime + ".csv"

add-content -path $LogFile -value "TimeCreated,PCName,AdminLogin"

$evs_new_pc = $evs_new_pc | sort TimeCreated | select TimeCreated,

@{n="User";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetSid"} | %{$_.’#text’}}},

@{n="UserName";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "TargetUserName"} | %{$_.’#text’}}},

@{n="AdminLogin";e={([xml]$_.ToXml()).Event.EventData.Data | ? {$_.Name -eq "SubjectUserSid"} | %{$_.’#text’}}}

foreach ($e in $evs_new_pc) {

$e_gr = $e_nm = $e_ab = @()

$e_gr = ResolveSID($e.User)

if (!$e_gr) {$e_gr = $e.UserName}

$e_ab = ResolveSID($e.AdminLogin)

add-content -path $LogFile -value "$($e.TimeCreated),$e_gr,$e_ab"

}

Wednesday, June 11, 2014

Script audit of basic events (create/delete user, create/delete group, change membership in group, create computer) in Active Directory.

Security log 32-bit Windows can be no larger than 512 MB. In the 64-bit version of the Security log size increased to 4 GB. So I want to share a script that checks the logs DCs and stores ".csv" file, the following events:
1. user added to a group,
2. user deleted from the group
3. user created,
4. user deleted,
5. group created,
6. group deleted,
7. computer generated

Pre to your computer to install the Active Directory module in PowerShell (http://blogs.msdn.com/b/rkramesh/archive/2012/01/17/how-to-add-active-directory-module-in-powershell-in-windows-7.aspx) And Log Parser 2.2 (http://www.microsoft.com/en-us/download/details.aspx?id=24659). At the beginning of the script you need to specify the domain (in example "contoso.com").
Execution of the script, you can schedule such as every 2 hours.

Download script

Import-Module ActiveDirectory -ErrorAction SilentlyContinue

$id = new-object 'System.DirectoryServices.ActiveDirectory.DirectoryContext'("domain", "contoso.com")
$dcs_id = [System.DirectoryServices.ActiveDirectory.DomainController]::FindAll($id)
$LogParser = "C:\Program Files (x86)\Log Parser 2.2\LogParser.exe"

function DelLFile([string] $path)
{
    $LFile = get-content $Path | measure-object -line
    if ($LFile.lines -eq 1)
    {
        write-host "Log file empty and deleted"
        Remove-Item $path
    }
}

### Add User to group in domain ID
$LastResults = $LastResults2 = $LastTime = $LogTime = $LogFolder = $LogFile = @()

$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "AddUserToGorup_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\AddUserToGorup"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults2 = import-csv $LastResults
    $LastTime = ($LastResults2.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,Group,NewMember,AddedBy`n"


foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        $LastTime
        if ($LastTime)
        { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS NewMember,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,5,'|'),'{}%%','')) AS AddedBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (4728;4732;4756)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS NewMember,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,5,'|'),'{}%%','')) AS AddedBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE (EventID IN (4728;4732;4756))""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LogParserStr
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        $LastTime
        if ($LastTime)
        { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group, RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS NewMember, RESOLVE_SID(SID) AS AddedBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (660;632;636)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group, RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS NewMember, RESOLVE_SID(SID) AS AddedBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE (EventID IN (660;632;636))""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LogParserStr
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile

### Delete User from group in domain ID
$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "DelUserFromGorup_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\DelUserFromGroup"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults = import-csv $LastResults
    $LastTime = ($LastResults.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,Group,DelMember,DelBy`n"

foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        if ($LastTime) { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS DelMember,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,5,'|'),'{}%%','')) AS DelBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (4729;4733;4757)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS DelMember,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,5,'|'),'{}%%','')) AS DelBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID IN (4729;4733;4757)""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        if ($LastTime)
        { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS DelMember,RESOLVE_SID(SID) AS DelBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (633;637;661))  and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT TimeGenerated,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,4,'|'),'{}%%','')) AS Group,RESOLVE_SID(REPLACE_CHR(EXTRACT_TOKEN(Strings,1,'|'),'{}%%','')) AS DelMember,RESOLVE_SID(SID) AS DelBy into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID IN (633;637;661)""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile

### Create User in domain ID
$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "CreateUser_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\CreateUser"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults = import-csv $LastResults
    $LastTime = ($LastResults.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,ComputerName,UserLogin,DomainName,AdminLogin`n"

foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID=4720) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID=4720""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        if ($LastTime) { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID=624) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID=624""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile

### Delete User in domain ID
$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "DelUser_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\DelUser"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults = import-csv $LastResults
    $LastTime = ($LastResults.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,ComputerName,UserLogin,DomainName,AdminLogin`n"

foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID=4726) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID=4726""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID=630) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as UserLogin,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID=630""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile

### Create Group in domain ID
$i = 1
$h = "ON"
$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "CreateGroup_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\CreateGroup"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults = import-csv $LastResults
    $LastTime = ($LastResults.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,ComputerName,GroupName,AdminLogin`n"

foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (4727;4731;4754)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID IN (4727;4731;4754)""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (631;658;635)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID IN (631;658;635)""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile

### Delete Group in domain ID
$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "DelGroup_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\DelGroup"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults = import-csv $LastResults
    $LastTime = ($LastResults.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,ComputerName,GroupName,AdminLogin`n"

foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (4730;4734;4758)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID IN (4730;4734;4758)""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        if ($LastTime)
        { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID IN (634;638;662)) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as GroupName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID IN (634;638;662)""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile

### Create PC in domain ID
$LogTime = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
$LogFile = "CreatePC_" + $LogTime + ".csv"
$LogFolder = ".\$($dcs_id.domain.name[0])\CreatePC"
New-Item -ItemType Directory -Force -Path $LogFolder
$LastResults = Get-ChildItem $LogFolder\*.csv -Recurse -ErrorAction SilentlyContinue | Where { !$_.PsIsContainer } | Sort LastWriteTime -descending | select -first 1
If ($LastResults)
{
    $LastResults = import-csv $LastResults
    $LastTime = ($LastResults.timegenerated | Measure -Max).Maximum
}
Add-Content $LogFolder\$LogFile "TimeGenerated,ComputerName,PCName,DomainName,AdminLogin`n"

foreach ($dc_id in $dcs_id)
{
    if ($dc_id.OSVersion -match "2008")
    {
        if ($LastTime) { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as PCName,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID = 4741) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as PCName,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,4,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID = 4741""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
    elseif ($dc_id.OSVersion -match "2003")
    {
        if ($LastTime) { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as PCName,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE ((EventID = 645) and (timegenerated > '$($LastTime)'))""" }
        else { $query = """SELECT timegenerated,computername,EXTRACT_TOKEN(Strings,0,'|') as PCName,EXTRACT_TOKEN(Strings,1,'|') as DomainName,EXTRACT_TOKEN(Strings,3,'|') as AdminLogin into $($LogFolder)\$($LogFile) FROM \\$($dc_id.Name)\security WHERE EventID = 645""" }
        $LogParserStr = "-i:evt -o:csv " + $query + " -headers:off -filemode:0 -stats:OFF"
        $dc_id.Name
        $LP = Start-Process -FilePath $LogParser -ArgumentList $LogParserStr -Wait -Passthru -NoNewWindow
    }
}
DelLFile $LogFolder\$logfile