###########################################################################" # # NAME: Get-ADGroupModificationsReport.ps1 # # AUTHOR: Jan Egil Ring # EMAIL: jan.egil.ring@powershell.no # # COMMENT: Generates a HTML-report of Active Directory group membership modifications (addings and deletions). # Specify a valid path on line 211 to store the report. # For more details, see the following blog-post: # http://janegilring.wordpress.com/2009/10/11/active-directory-group-membership-modifications-report # # You have a royalty-free right to use, modify, reproduce, and # distribute this script file in any way you find useful, provided that # you agree that the creator, owner above has no warranty, obligations, # or liability for such use. # # VERSION HISTORY: # 1.0 11.10.2009 - Initial release # ###########################################################################" #Requires -Version 2.0 Function Get-CustomHTML ($Header){ $Report = @" $($Header) $($Header)

Generated on $($ENV:Computername)
Report created on $(Get-Date)

"@ Return $Report } Function Get-CustomHeader0 ($Title){ $Report = @"

$($Title)

"@ Return $Report } Function Get-CustomHeader ($Num, $Title){ $Report = @"

$($Title)

"@ Return $Report } Function Get-CustomHeaderClose{ $Report = @"

"@ Return $Report } Function Get-CustomHeader0Close{ $Report = @"

"@ Return $Report } Function Get-CustomHTMLClose{ $Report = @" "@ Return $Report } Function Get-HTMLTable { param([array]$Content) $HTMLTable = $Content | ConvertTo-Html $HTMLTable = $HTMLTable -replace "", "" $HTMLTable = $HTMLTable -replace "", "" $HTMLTable = $HTMLTable -replace "", "" $HTMLTable = $HTMLTable -replace '', "" $HTMLTable = $HTMLTable -replace '', "" $HTMLTable = $HTMLTable -replace 'HTML TABLE', "" $HTMLTable = $HTMLTable -replace '', "" $HTMLTable = $HTMLTable -replace '', "" Return $HTMLTable } Function Get-HTMLDetail ($Heading, $Detail){ $Report = @"

$Heading	$($Detail)

"@ Return $Report } function isWithin([int]$days, [datetime]$Date) { [DateTime]::Now.AddDays($days).Date -le $Date.Date } #Initialize array for domain controllers in the current domain $domaincontrollers = @() #Get current domain $dom = [System.DirectoryServices.ActiveDirectory.Domain]::getcurrentdomain() #Get domain controllers in the current domain and add them to the $domain controllers array $dom.DomainControllers | select Name | ForEach-Object {$domaincontrollers += $_.name} $MyReport = Get-CustomHTML "Active Directory Group Modifications - Daily Report" $MyReport += Get-CustomHeader0 ("$domaincontroller") # ---- General Summary Info ---- $MyReport += Get-CustomHeader "1" "General Details" $MyReport += Get-HTMLDetail "Domain name:" $dom $MyReport += Get-HTMLDetail "Number of Domain Controllers:" $domaincontrollers.count $MyReport += Get-CustomHeaderClose foreach ($domaincontroller in $domaincontrollers){ # ---- Members added to Domain Local Groups ---- $MyReport += Get-CustomHeader "1" "Members added to Domain Local Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable (Get-EventLog -LogName 'Security' -ComputerName $domaincontroller | Where-Object {(isWithin -1 $_.TimeWritten) -and $_.EventID -eq "636" -or $_.EventID -eq "4732"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members removed from Domain Local Groups ---- $MyReport += Get-CustomHeader "1" "Members removed from Domain Local Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable (Get-EventLog -LogName 'Security' -ComputerName $domaincontroller | Where-Object {(isWithin -1 $_.TimeWritten) -and $_.EventID -eq "637" -or $_.EventID -eq "4733"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members added to Global Groups ---- $MyReport += Get-CustomHeader "1" "Members added to Global Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable (Get-EventLog -LogName 'Security' -ComputerName $domaincontroller | Where-Object {(isWithin -1 $_.TimeWritten) -and $_.EventID -eq "632" -or $_.EventID -eq "4728"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members removed from Global Groups ---- $MyReport += Get-CustomHeader "1" "Members removed from Global Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable (Get-EventLog -LogName 'Security' -ComputerName $domaincontroller | Where-Object {(isWithin -1 $_.TimeWritten) -and $_.EventID -eq "633" -or $_.EventID -eq "4729"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members added to Universal Groups ---- $MyReport += Get-CustomHeader "1" "Members added to Universal Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable (Get-EventLog -LogName 'Security' -ComputerName $domaincontroller | Where-Object {(isWithin -1 $_.TimeWritten) -and $_.EventID -eq "660" -or $_.EventID -eq "4756"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members removed from Universal Groups ---- $MyReport += Get-CustomHeader "1" "Members removed from Universal Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable (Get-EventLog -LogName 'Security' -ComputerName $domaincontroller | Where-Object {(isWithin -1 $_.TimeWritten) -and $_.EventID -eq "661" -or $_.EventID -eq "4757"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose } $Date = Get-Date $Filename = "C:\Temp\" + "DailyReport" + "_" + $Date.Day + "-" + $Date.Month + "-" + $Date.Year + ".htm" $MyReport | out-file -encoding ASCII -filepath $Filename