I'm trying to find out which AD objects have been renamed in AD through either UI or power shell command.
Thanks
I'm trying to find out which AD objects have been renamed in AD through either UI or power shell command.
Thanks
@BlueSky-8252
Thank you for your post!
When you say AD object can you share what specific objects you're referring to?
Are these objects part of your on-prem Active Directory? Or Azure Active Directory?
Can you share any scripts you have so far, so our community can continue to build off of any scripts you're working on?
Any additional details would be greatly appreciated.
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
@BlueSky-8252
Thank you for the quick response!
Since this is on-prem AD, I've added the "windows-active-directory" tag to this thread so our AD team can take a closer look into this, and removed the "azure-ad-group-management" tag.
Thank you for your time and patience throughout this issue.
Hi,
Is there any update? Have you got a chance to verify the below suggestions?
Please feel free to let us know if more assistance is needed. If the reply is helpful, please “Accept Answer” to help other community members find it more easily.
Hi,
You have to enable auditing on the AD objects you want to monitor then the activities will be recorded in the Security Event Log. You may refer to the links below for more details.
AD DS Auditing Step-by-Step Guide
How to enable auditing of AD objects
How to Enable the Security Auditing of Active Directory
Once the events have been logged you can parse the Security Event Log. Suppose you want to get the AD objects renamed after 2021-04-05 20:30, then you can do something like this.
$date = "2021-04-05 20:30"
$AttributeGuid = 'bf967a0e-0de6-11d0-a285-00aa003049e2' # Attribute Name
$AccessId = '7685' # Write Property
$ADObjects = @()
Get-EventLog -LogName security -After $date -InstanceId 4662 | where-object {$_.Message -match $AttributeGuid -and $_.Message -match $AccessId }|
ForEach-Object {
$_.Message -match '(?<=Object Name:[\s]+%{)[-\w]+(?=})' | Out-Null
$ADObjects += Get-ADObject -Identity $Matches[0]
}
$ADObjects
Best Regards,
Ian Xue
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
4 people are following this question.