Monitoring Active Directory Group Membership Changes

Monitoring Active Directory Group Membership Changes

For security reasons, users in an Active Directory (AD) network would be put in groups, and they will be granted or denied certain privileges according to the groups they belong to. This is done so that users do not have unnecessary access to sensitive organization information. However, the roles of the users in an organization keep changing, and hence, it is also important to monitor their group membership and change it accordingly. PowerShell can help make this task easy. Using the tool, administrators can collect the Windows Security Log to track an AD user account's group membership changes. This script can also be made to run periodically using Windows Task Scheduler. Here's the script that will let you monitor the AD groups and send an email if someone is changing the membership settings:
 
  1. # Get domain controllers list
  2. $DCs = Get-ADDomainController -Filter *

  4. # Define timeframe for report (default is 1 day)
  5. $startDate = (get-date).AddDays(-1)

  7. # Store group membership changes events from the security event logs in an array.
  8. foreach ($DC in $DCs){
  9. $events = Get-Eventlog -LogName Security -ComputerName $DC.Hostname -after $startDate | where {$_.eventID -eq 4728 -or $_.eventID -eq 4729}}

  11. # Loop through each stored event; print all changes to security global group members with when, who, what details.

  13.   foreach ($e in $events){
  14.     # Member Added to Group

  16.     if (($e.EventID -eq 4728 )){
  17.       write-host "Group: "$e.ReplacementStrings[2] "`tAction: Member added `tWhen: "$e.TimeGenerated "`tWho: "$e.ReplacementStrings[6] "`tAccount added: "$e.ReplacementStrings[0]
  18.     }
  19.     # Member Removed from Group
  20.     if (($e.EventID -eq 4729 )) {
  21.       write-host "Group: "$e.ReplacementStrings[2] "`tAction: Member removed `tWhen: "$e.TimeGenerated "`tWho: "$e.ReplacementStrings[6] "`tAccount removed: "$e.ReplacementStrings[0]
  22.     }}