At my company, the system administrators separate admin accounts to administer our server infrastructure. These admin accounts are often powerful accounts which get their power from group membership (Role Based Access Control a.k.a. RBAC). Therefore, I would like to receive a notification via e-mail when a user account is added to or removed from a group (in my previous post I shared with you a script to monitor just that), but added to that I also would like to receive a notification when for example the Password Never Expires option is ticked. Other scenarios may include notification when an admin account is created or deleted. Or when the password of an admin account has been changed. And I would like to know who has made these changes and when. As and added benifit, you can also claim to any auditor that you have a log of all changed made to your admin accounts by simply saving the e-mails.

In this post I would like to share with you the script I have made to monitor AD user account changes. This script will check all user account related events from the last hour. You can implement this script by running it every hour via a scheduled task.
Continue reading Monitor AD user account changes →