question

BlueSky-8252 avatar image
0 Votes"
BlueSky-8252 asked IanXue-MSFT commented

Powershell Command to show renamed AD object?

I'm trying to find out which AD objects have been renamed in AD through either UI or power shell command.

Thanks

windows-server-powershellwindows-active-directory
· 4
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

@BlueSky-8252
Thank you for your post!

  • When you say AD object can you share what specific objects you're referring to?

  • Are these objects part of your on-prem Active Directory? Or Azure Active Directory?

  • Can you share any scripts you have so far, so our community can continue to build off of any scripts you're working on?

Any additional details would be greatly appreciated.


If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

0 Votes 0 ·

user objects
On-prem AD

No scripts from my end.

Thanks

0 Votes 0 ·

@BlueSky-8252
Thank you for the quick response!

Since this is on-prem AD, I've added the "windows-active-directory" tag to this thread so our AD team can take a closer look into this, and removed the "azure-ad-group-management" tag.


Thank you for your time and patience throughout this issue.

0 Votes 0 ·

Hi,
Is there any update? Have you got a chance to verify the below suggestions?
Please feel free to let us know if more assistance is needed. If the reply is helpful, please “Accept Answer” to help other community members find it more easily.

0 Votes 0 ·
IanXue-MSFT avatar image
0 Votes"
IanXue-MSFT answered IanXue-MSFT edited

Hi,

You have to enable auditing on the AD objects you want to monitor then the activities will be recorded in the Security Event Log. You may refer to the links below for more details.

AD DS Auditing Step-by-Step Guide
How to enable auditing of AD objects
How to Enable the Security Auditing of Active Directory

Once the events have been logged you can parse the Security Event Log. Suppose you want to get the AD objects renamed after 2021-04-05 20:30, then you can do something like this.

 $date = "2021-04-05 20:30"
 $AttributeGuid = 'bf967a0e-0de6-11d0-a285-00aa003049e2' # Attribute Name
 $AccessId = '7685' # Write Property
 $ADObjects = @()
 Get-EventLog -LogName security -After $date -InstanceId 4662 | where-object {$_.Message -match $AttributeGuid -and $_.Message -match $AccessId }| 
     ForEach-Object {
         $_.Message -match '(?<=Object Name:[\s]+%{)[-\w]+(?=})' | Out-Null
         $ADObjects += Get-ADObject -Identity $Matches[0]
     }
 $ADObjects

Best Regards,
Ian Xue
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Chris-1748 avatar image
0 Votes"
Chris-1748 answered
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.