###########################################################################" # # NAME: Get-ADGroupModificationsReport.ps1 # # AUTHOR: Jan Egil Ring # EMAIL: jan.egil.ring@powershell.no # # COMMENT: Generates a HTML-report of Active Directory group membership modifications (addings and deletions). # Specify a valid path on line 211 to store the report. # For more details, see the following blog-post: # http://blog.powershell.no/2009/10/11/active-directory-group-membership-modifications-report # # You have a royalty-free right to use, modify, reproduce, and # distribute this script file in any way you find useful, provided that # you agree that the creator, owner above has no warranty, obligations, # or liability for such use. # # VERSION HISTORY: # 1.0 11.10.2009 - Initial release # 1.1 29.04.2010 - Enhanced the script performance by storing each domain controllers security eventlog in a variable # ###########################################################################" #Requires -Version 2.0 function Get-CustomHTML ($Header){ $Report = @" $($Header) $($Header)

Generated on $($ENV:Computername)
Report created on $(Get-Date)

"@ return $Report } function Get-CustomHeader0 ($Title){ $Report = @"

$($Title)

"@ return $Report } function Get-CustomHeader ($Num, $Title){ $Report = @"

$($Title)

"@ return $Report } function Get-CustomHeaderClose{ $Report = @"

"@ return $Report } function Get-CustomHeader0Close{ $Report = @"

"@ return $Report } function Get-CustomHTMLClose{ $Report = @" "@ return $Report } function Get-HTMLTable { param([array]$Content) $HTMLTable = $Content | ConvertTo-Html $HTMLTable = $HTMLTable -replace "", "" $HTMLTable = $HTMLTable -replace "", "" $HTMLTable = $HTMLTable -replace "", "" $HTMLTable = $HTMLTable -replace '', "" $HTMLTable = $HTMLTable -replace '', "" $HTMLTable = $HTMLTable -replace 'HTML TABLE', "" $HTMLTable = $HTMLTable -replace '', "" $HTMLTable = $HTMLTable -replace '', "" return $HTMLTable } function Get-HTMLDetail ($Heading, $Detail){ $Report = @"

$Heading	$($Detail)

"@ return $Report } #Initialize array for domain controllers in the current domain $domaincontrollers = @() #Get current domain $dom = [System.DirectoryServices.ActiveDirectory.Domain]::getcurrentdomain() #Get domain controllers in the current domain and add them to the $domain controllers array $dom.DomainControllers | select Name | ForEach-Object {$domaincontrollers += $_.name} $MyReport = Get-CustomHTML "Active Directory Group Modifications - Daily Report" $MyReport += Get-CustomHeader0 ("$domaincontroller") # ---- General Summary Info ---- $MyReport += Get-CustomHeader "1" "General Details" $MyReport += Get-HTMLDetail "Domain name:" $dom $MyReport += Get-HTMLDetail "Number of Domain Controllers:" $domaincontrollers.count $MyReport += Get-CustomHeaderClose foreach ($domaincontroller in $domaincontrollers){ $eventlog = Get-EventLog -LogName ‘Security’ -ComputerName $domaincontroller -After ((Get-Date).AddDays(-1)) # ---- Members added to Domain Local Groups ---- $MyReport += Get-CustomHeader "1" "Members added to Domain Local Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable ($eventlog | Where-Object {$_.EventID -eq "636" -or $_.EventID -eq "4732"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members removed from Domain Local Groups ---- $MyReport += Get-CustomHeader "1" "Members removed from Domain Local Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable ($eventlog | Where-Object {$_.EventID -eq "637" -or $_.EventID -eq "4733"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members added to Global Groups ---- $MyReport += Get-CustomHeader "1" "Members added to Global Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable ($eventlog | Where-Object {$_.EventID -eq "632" -or $_.EventID -eq "4728"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members removed from Global Groups ---- $MyReport += Get-CustomHeader "1" "Members removed from Global Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable ($eventlog | Where-Object {$_.EventID -eq "633" -or $_.EventID -eq "4729"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members added to Universal Groups ---- $MyReport += Get-CustomHeader "1" "Members added to Universal Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable ($eventlog | Where-Object {$_.EventID -eq "660" -or $_.EventID -eq "4756"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose # ---- Members removed from Universal Groups ---- $MyReport += Get-CustomHeader "1" "Members removed from Universal Groups on domaincontroller $domaincontroller" $MyReport += Get-HTMLTable ($eventlog | Where-Object {$_.EventID -eq "661" -or $_.EventID -eq "4757"} | select TimeGenerated,Message ) $MyReport += Get-CustomHeaderClose $MyReport += Get-CustomHeader0Close $MyReport += Get-CustomHTMLClose } $Date = Get-Date $Filename = "C:\Temp\" + "DailyReport" + "_" + $Date.Day + "-" + $Date.Month + "-" + $Date.Year + ".htm" $MyReport | out-file -encoding ASCII -filepath $Filename