{"componentChunkName":"component---src-templates-articles-index-jsx","path":"/articles/monitor-active-directory-groups-through-powershell/","result":{"data":{"props":{"adsense":true,"adsenseMobile":null,"byLine":"","canonical":"https://staging.business.com/articles/monitor-active-directory-groups-through-powershell/","content":"

To provide a secure environment, it's critical to ensure that no unwanted Active Directory (AD) users or groups are added to authoritative AD groups.

\n

Administrators can assign rights to specific users and control who can and cannot add and remove group members from essential groups, but it's still critical to monitor groups like Enterprise Admins and Domain Admins for new members. Using PowerShell, we can create a monitor to do just that.

\r\n
 
\r\n

Prerequisites for using PowerShell to monitor AD

\r\n

If you'd like to follow along with this article, I'll be assuming a few things:

\r\n
    \n
  1. You are working on a computer that's already joined to an Active Directory domain.
    2. \r\n
  2. You are logged in with a user with rights to read AD group memberships.
    3. \r\n
  3. You have the Remote Server Administration Tools (RSAT) package installed.
    4. \r\n
  4. You have an intermediate level of knowledge about PowerShell.
    5. \r\n
\n

With those prerequisites out of the way, let's see how we can monitor AD groups for changes with PowerShell.

\r\n

How to get started with using PowerShell to monitor AD

\r\n

Creating an AD group monitor in PowerShell is a five-step process:

\r\n
    \n
  1. Read the previous group membership.
    2. \r\n
  2. Read the current group membership.
    3. \r\n
  3. Store the current group membership.
    4. \r\n
  4. Compare group memberships.
    5. \r\n
  5. Take action.
    6. \r\n
\n

First, we need to figure out how to read group memberships in PowerShell. The easiest way to do that is with the Get-AdGroupMember command in the ActiveDirectory PowerShell module. Using this command, we can pull out all of the group members. I'll be using the Domain Admins group as an example throughout this article.

\r\n

\"\"

\r\n

Once we have the current list of members, we then need to store that list somewhere so we can read it later. I'll use a CSV file. Since I'd like to know when that membership is recorded, I'll also include the time.

\r\n

\"\"

\r\n
 
\r\n

Next, since I now have a CSV file to query, I can create some code to query the previous group membership. Below I'm querying our state file and finding the latest time the file has.

\r\n

\"\"

\r\n

Next, I can create some code to compare the previous and current members and then run some code to take whatever action I need to if my monitor detects a difference in membership.

\r\n

\"\"

\r\n

Once I have all of the steps in place, I can bring it all together in a script and run it.

\r\n

\"\"

\r\n

When run, the script will then create a file called C:\\DomainAdminGroupMemberShip.csv and C:\\DomainAdminsGroupChanges.csv that will contain the list of group members every time the script is run and whether or not the group membership changed during that run.

\r\n

Protecting your environment with PowerShell

\r\n

Building an AD group membership monitor with PowerShell allows you to create a free, custom solution that's highly flexible and can easily be tuned to your environment. Once you have the script, this script can be executed at regular intervals using a Windows scheduled task or another execution engine of your choosing.

\r\n
 
\n","docType":"article","guid":"articles_6506b5caf4f0cc6efc3504f9c240c06c","lastModified":"2019-04-29T13:00:00.000Z","published":"2019-04-29T13:00:00.000Z","structuredData":null,"subtitle":"Protect your Active Directory groups by monitoring them through Microsoft's PowerShell.","template":"v1","title":"Monitoring Active Directory Groups for Changes With PowerShell","type":"article","author":{"avatar":null,"bio":"Adam Bertram is a 20-year veteran of IT and experienced online business professional. He's an entrepreneur, IT influencer, Microsoft MVP, blogger, trainer and content marketing writer for multiple technology companies. Adam is also the founder of the popular IT career development platform TechSnips. Catch up on Adam's articles at adamtheautomator.com, connect on LinkedIn, or follow him on Twitter at @adbertram or the TechSnips Twitter account at @techsnips_io.","name":"Adam Bertram","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/adambertram/","twitter":"https://twitter.com/adbertram","website":"https://www.adamtheautomator.com/"},"status":"enabled","title":null,"type":"Contributing Writer","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"eGain Communications","jobTitle":"Product Management Analyst","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Technology Solutions","slug":"technology-solutions"}},"meta":{"robots":"index, follow","description":"Make sure only the administrators can control Active Directory groups through Microsoft PowerShell.","title":"Using PowerShell to Monitor Active Directory Groups - business.com"},"parsedContent":{"toc":[{"id":"prerequisites-for-using-powershell-to-monitor-ad","title":"Prerequisites for using PowerShell to monitor AD"},{"id":"how-to-get-started-with-using-powershell-to-monitor-ad","title":"How to get started with using PowerShell to monitor AD"},{"id":"protecting-your-environment-with-powershell","title":"Protecting your environment with PowerShell"}],"json":[{"component":"p","children":["To provide a secure environment, it's critical to ensure that no unwanted Active Directory (AD) users or groups are added to authoritative AD groups."]},{"component":"p","children":["Administrators can assign rights to specific users and control who can and cannot add and remove group members from essential groups, but it's still critical to monitor groups like Enterprise Admins and Domain Admins for new members. Using PowerShell, we can create a monitor to do just that."]},{"component":"div","props":{"id":"ad_leaderboard"},"children":[" "]},{"component":"h2","props":{"id":"prerequisites-for-using-powershell-to-monitor-ad"},"children":["Prerequisites for using PowerShell to monitor AD"]},{"component":"p","children":["If you'd like to follow along with this article, I'll be assuming a few things:"]},{"component":"ol","children":[{"component":"li","children":["You are working on a computer that's already joined to an Active Directory domain."]},{"component":"li","children":["You are logged in with a user with rights to read AD group memberships."]},{"component":"li","children":["You have the ",{"component":"a","props":{"href":"https://www.microsoft.com/en-us/download/details.aspx?id=45520","target":"_blank"},"children":["Remote Server Administration Tools (RSAT) package"]}," installed."]},{"component":"li","children":["You have an intermediate level of knowledge about PowerShell."]}]},{"component":"p","children":["With those prerequisites out of the way, let's see how we can monitor AD groups for changes with PowerShell."]},{"component":"h2","props":{"id":"how-to-get-started-with-using-powershell-to-monitor-ad"},"children":["How to get started with using PowerShell to monitor AD"]},{"component":"p","children":["Creating an AD group monitor in PowerShell is a five-step process:"]},{"component":"ol","children":[{"component":"li","children":["Read the previous group membership."]},{"component":"li","children":["Read the current group membership."]},{"component":"li","children":["Store the current group membership."]},{"component":"li","children":["Compare group memberships."]},{"component":"li","children":["Take action."]}]},{"component":"p","children":["First, we need to figure out how to read group memberships in PowerShell. The easiest way to do that is with the Get-AdGroupMember command in the ActiveDirectory PowerShell module. Using this command, we can pull out all of the group members. I'll be using the Domain Admins group as an example throughout this article."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"https://www.business.com/images/content/5cc/367b67b4374301e8b4574/742_-48- 742w, https://www.business.com/images/content/5cc/367b67b4374301e8b4574/412_-26- 412w, https://www.business.com/images/content/5cc/367b67b4374301e8b4574/206_-13- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"https://www.business.com/images/content/5cc/367b67b4374301e8b4574/631-41-","alt":"","width":"631","height":"41","data-content-img-id":"5cc367b67b4374301e8b4574"}}]}]},{"component":"p","children":["Once we have the current list of members, we then need to store that list somewhere so we can read it later. I'll use a CSV file. Since I'd like to know when that membership is recorded, I'll also include the time."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"https://www.business.com/images/content/5cc/369847b4374331e8b4577/742_-137- 742w, https://www.business.com/images/content/5cc/369847b4374331e8b4577/412_-76- 412w, https://www.business.com/images/content/5cc/369847b4374331e8b4577/206_-38- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"https://www.business.com/images/content/5cc/369847b4374331e8b4577/633-117-","alt":"","width":"633","height":"117","data-content-img-id":"5cc369847b4374331e8b4577"}}]}]},{"component":"div","props":{"id":"in-article-vca-1"},"children":[" "]},{"component":"p","children":["Next, since I now have a CSV file to query, I can create some code to query the previous group membership. Below I'm querying our state file and finding the latest time the file has."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"https://www.business.com/images/content/5cc/369cd7b4374301e8b4578/742_-68- 742w, https://www.business.com/images/content/5cc/369cd7b4374301e8b4578/412_-37- 412w, https://www.business.com/images/content/5cc/369cd7b4374301e8b4578/206_-18- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"https://www.business.com/images/content/5cc/369cd7b4374301e8b4578/641-59-","alt":"","width":"641","height":"59","data-content-img-id":"5cc369cd7b4374301e8b4578"}}]}]},{"component":"p","children":["Next, I can create some code to compare the previous and current members and then run some code to take whatever action I need to if my monitor detects a difference in membership."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"https://www.business.com/images/content/5cc/36a115a215ee97e8b4582/742_-154- 742w, https://www.business.com/images/content/5cc/36a115a215ee97e8b4582/412_-85- 412w, https://www.business.com/images/content/5cc/36a115a215ee97e8b4582/206_-42- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"https://www.business.com/images/content/5cc/36a115a215ee97e8b4582/633-132-","alt":"","width":"633","height":"132","data-content-img-id":"5cc36a115a215ee97e8b4582"}}]}]},{"component":"p","children":["Once I have all of the steps in place, I can bring it all together in a script and run it."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"https://www.business.com/images/content/5cc/36a707b4374321e8b456c/742_-566- 742w, https://www.business.com/images/content/5cc/36a707b4374321e8b456c/412_-314- 412w, https://www.business.com/images/content/5cc/36a707b4374321e8b456c/206_-157- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"https://www.business.com/images/content/5cc/36a707b4374321e8b456c/650-496-","alt":"","width":"650","height":"496","data-content-img-id":"5cc36a707b4374321e8b456c"}}]}]},{"component":"p","children":["When run, the script will then create a file called C:\\DomainAdminGroupMemberShip.csv and C:\\DomainAdminsGroupChanges.csv that will contain the list of group members every time the script is run and whether or not the group membership changed during that run."]},{"component":"h2","props":{"id":"protecting-your-environment-with-powershell"},"children":["Protecting your environment with PowerShell"]},{"component":"p","children":["Building an AD group membership monitor with PowerShell allows you to create a free, custom solution that's highly flexible and can easily be tuned to your environment. Once you have the script, this script can be executed at regular intervals using a Windows scheduled task or another execution engine of your choosing."]},{"component":"div","props":{"id":"in-article-vca-2"},"children":[" "]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5cc/36c3a5a215eed7e8b457e/1500-0-","caption":"REDPIXEL.PL/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"Developing a Patch Rollout Plan With PowerShell","canonical":"https://www.business.com/articles/patch-rollout-plan-powershell/","slug":"patch-rollout-plan-powershell","thumbnail":"https://www.business.com/images/content/5ca/cbe085a215e4d598b458f/1500-0-","dek":"PowerShell allows you to plan your deployment strategy for Microsoft's Patch Tuesday.","lastModified":"2019-04-11T12:41:00Z","published":"2019-04-11T12:41:00Z","sponsored":false},{"title":"5 Steps To Speed Up A WordPress Website","canonical":"https://www.business.com/articles/how-to-speed-up-wordpress-website/","slug":"how-to-speed-up-wordpress-website","thumbnail":"https://www.business.com/images/content/5e6/8e4b29c658a8e608b456d/1500-0-","dek":"In 2020 site speed has become more important than ever to increase your visibility online (SEO) and maximise conversion rate once they come to your website. I'll explain how I maximised the speed of my site and how to measure this critical metric.","lastModified":"2020-03-11T16:18:00Z","published":"2020-03-11T16:18:00Z","sponsored":false},{"title":"Delegating PowerShell Scripts with ScriptRunner","canonical":"https://www.business.com/articles/powershell-scripts-scriptrunner/","slug":"powershell-scripts-scriptrunner","thumbnail":"https://www.business.com/images/content/5d0/7d9da5a215e820b8b4573/1500-0-","dek":"Ensure your team can leverage PowerShell scripts securely.","lastModified":"2019-06-19T12:46:00Z","published":"2019-06-19T12:46:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Managing Active Directory","canonical":"https://www.business.com/articles/powershell-active-directory-cmdlets/","slug":"powershell-active-directory-cmdlets","thumbnail":"https://www.business.com/images/content/5cf/90cab7b4374ab068b456f/1500-0-","dek":"Administering Active Directory is one of the most critical roles in any Windows network.","lastModified":"2018-09-04T08:00:00Z","published":"2018-09-04T08:00:00Z","sponsored":false},{"title":"Remote PC Security – Is It Safe?","canonical":"https://www.business.com/articles/is-remote-pc-safe/","slug":"is-remote-pc-safe","thumbnail":"https://www.business.com/images/content/5ee/b50685a215e2f498b4569/1500-0-","dek":"Accessing a work computer over the internet is a common way to work from home with little disruption. With entire computer systems in the balance, though, keeping everything secure is paramount.","lastModified":"2020-06-18T11:30:00Z","published":"2020-06-18T11:30:00Z","sponsored":false},{"title":"5 Ways to Incorporate Artificial Intelligence in Your Business for Exponential Growth","canonical":"https://www.business.com/articles/how-to-implement-ai-for-business-growth/","slug":"how-to-implement-ai-for-business-growth","thumbnail":"https://www.business.com/images/content/5e5/53ed47b4374a9458b4576/1500-0-","dek":"Artificial Intelligence isn’t set to happen in the future because the future is here! Learn how to use this in your business to skyrocket your business growth.","lastModified":"2020-02-25T18:38:00Z","published":"2020-02-25T18:38:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Auditing And Maintaining Storage","canonical":"https://www.business.com/articles/powershell-for-storage/","slug":"powershell-for-storage","thumbnail":"https://www.business.com/images/content/5d0/18e065a215ea2498b4588/1500-0-","dek":"PowerShell v5 offers some new features for managing storage.","lastModified":"2018-09-04T11:00:00Z","published":"2018-09-04T11:00:00Z","sponsored":false},{"title":"Should You Hire a Software Development Company for Your Project?","canonical":"https://www.business.com/articles/how-to-hire-a-software-developer/","slug":"how-to-hire-a-software-developer","thumbnail":"https://www.business.com/images/content/5dd/572ed5a215e81188b4570/1500-0-","dek":"In this era of technology, the demand for software development firms is on a constant rise. Choosing the best software development company is really a daunting task. This post helps you to know why you should a software development firm for your project","lastModified":"2019-11-21T23:00:00Z","published":"2019-11-21T23:00:00Z","sponsored":false},{"title":"App Development Solutions That Won't Break the Bank","canonical":"https://www.business.com/articles/inexpensive-app-development-solutions/","slug":"inexpensive-app-development-solutions","thumbnail":"https://www.business.com/images/content/5e9/75dea5a215ef9458b4575/1500-0-","dek":"Learn more about what your business needs to tackle app development.","lastModified":"2020-04-15T22:18:00Z","published":"2020-04-15T22:18:00Z","sponsored":false},{"title":"Why Voice-Based Technology is the Future of Excellent Customer Experience","canonical":"https://www.business.com/articles/voice-technology-will-change-the-customer-experience/","slug":"voice-technology-will-change-the-customer-experience","thumbnail":"https://www.business.com/images/content/5df/660047b4374e73c8b4567/1500-0-","dek":"Why voice technology will shift customer experience expectations, and how to embrace the sea change.","lastModified":"2019-12-16T14:30:00Z","published":"2019-12-16T14:30:00Z","sponsored":false},{"title":"Using PowerShell to Manage the Windows Event Log","canonical":"https://www.business.com/articles/powershell-manage-windows-event-log/","slug":"powershell-manage-windows-event-log","thumbnail":"https://www.business.com/images/content/5ca/782507b437408768b457f/1500-0-","dek":"PowerShell has two cmdlets that can help your Windows administrator read the event log.","lastModified":"2019-04-08T19:00:00Z","published":"2019-04-08T19:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df3d8695a215e58428b4570/POS_GETTY_DERO2084.jpg","canonical":"https://staging.business.com/categories/best-pos-systems/","title":"The Best POS Systems of 2021","dek":"Before you choose a POS system, check out our reviews of the best picks for 2021. ","slug":"best-pos-systems","lastModified":"2021-03-17T17:33:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-04-29T13:00:00.000Z","template":"v1","title":"Monitoring Active Directory Groups for Changes With PowerShell","meta":{"robots":"index, follow"},"docType":"articles","slug":"monitor-active-directory-groups-through-powershell","canonical":"https://staging.business.com/articles/monitor-active-directory-groups-through-powershell/","skipTOC":false}},"staticQueryHashes":[]}