IsraelTorres

who-reset-the-password-in-ad/

Dec 28th, 2018
183
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. // http://woshub.com/who-reset-the-password-in-ad/
  2.  
  3. (Get-ADComputer -SearchBase ‘OU=Domain Controllers,DC=woshub,DC=com’ -Filter *).Name | foreach {
  4. Get-WinEvent -ComputerName $_ -FilterHashtable @{LogName="Security";ID=4724 }| Foreach {
  5. $event = [xml]$_.ToXml()
  6. if($event)
  7. {
  8. $Time = Get-Date $_.TimeCreated -UFormat "%Y-%d-%m %H:%M:%S"
  9. $AdmUser = $event.Event.EventData.Data[4]."#text"
  10. $User = $event.Event.EventData.Data[0]."#text"
  11. $dc = $event.Event.System.computer
  12. write-host “Admin ” $AdmUser “ resets password to ” $User “ on ” $dc “ “ $Time
  13. }
  14. }
  15. }
RAW Paste Data