event – Knowledge Base

AD DS: Collect User cmd history

Posted on: 30 March, 2021 30 March, 2021
Author: niklas
Tags: 4688, ADDS, Audit, event, forensic, Microsoft, Powershell, Windows, Windows Server
Comment(s): AD DS: Collect User cmd history

After enabling auditing for event 4688, see post about auditing Microsoft AD DS(TBD). You can collect logs to see cmd activity for a user. I have wrote this powershell function little quick to help me out with this. But I do recommend an greylog for this purpose.

AD DS: Collect User Logon History

Posted on: 30 March, 2021 30 March, 2021
Author: niklas
Tags: ADDS, Audit, event, forensic, logon, Microsoft, Powershell, Windows, Windows Server
Comment(s): AD DS: Collect User Logon History

After enabling auditing for event 4624, see post about auditing Microsoft AD DS(TBD). You can collect logs to see login activity for a user. I have wrote this powershell function little quick to help me out with this. But I do recommend an greylog for this purpose.