Audit AD workstations

Question

Hi,I'd like to audit an AD environment  and want to include domain users computers. is there  tool i can use to have audit information on the computers like user accounts infos, os versions...without having to go on computers one by one?Thanks for your help.

petersaraby · Answer

There are a few options depending on how deep you want to go with the auditing, and whether you want to see things like a logon history for users logging on to the workstations.

A plain "AD Audit" product may not be sufficient, since those will just focus on monitoring the actual AD itself, not servers, workstations etc. Regular log monitoring solutions won't tell you anything about installed software and patches.

Scripts may be able to do the trick, if you are looking for something very specific and don't mind running that on a schedule and have a way good way to sift through the info the script returns.

And, finally, inventory products won't actually monitor your AD, although they will excel with things like software inventory, patches etc.

Maybe take a look at EventSentry which has a pretty comprehensive feature set for these types of things. It monitors servers and workstations for both security & performance, but also has an AD monitoring component. It also tells you the latest build a workstation is on, along with a list of installed patches. It also has a feature where it flags computers that are not on the latest build/patch release by Microsoft. Oh, regarding user accounts, with its AD component you can see a list of all users in a domain, but I don't think you can see that for member servers and workstations (although you can see almost anything else, not sure why that's not included?). However, Windows audits just about anything, so you would be able to see if a user is added or removed.

Spice (1) flagReport

1 found this helpful thumb_up thumb_down

Brian745345 · Answer

like what version of Windows is on it? It shows which build and which version it's on. Current LS user.

Kenny8416 · Answer

I believe so, yes, it's been a few years since I used it (previous job), so can't check unfortuantely.

It will definitely list which KB's are installed, I think there is probably a report of machines that don't meet the latest, but can't be 100% sure.

local_offer Tagged Items
Lansweeperstar4

Spice (2) flagReport

2 found this helpful thumb_up thumb_down

manulinx · Answer

Kenny8416 Does

Lansweeper gives also information on latest Microsoft kb applied?

manulinx · Answer

Thanks for your suggestions i'll check those tools.

Br@d · Answer

depending on what info you want, a lot can be pulled from AD via powershell.  For example to get a list of all computer accounts and their OS you can use:
get-adcomputer -filter * -properties operatingsystem,Name | Select-Object Operatingsystem,name |Sort-Object Operatingsystemthe get-adcomputer does require running from a system with RSAT installed (or a DC)

Kenny8416 · Answer

Lansweeper may be a good option for you, free up to a point as far as I rememberSpiceworks network monitor may also work, but i've never used it

Br@d · Answer

you might want to let the dust settle a bit more before looking into ManageEngine. They have had a number of high and critical CVE over the past few months and are actively being targeted https://www.zdnet.com/article/fbi-warning-hackers-are-targeting-this-flaw-in-zoho-manageengine-servi...

Brian745345 · Answer

Spiceworks free version has a limited amount of PC's that you can scan with their free version. I believe it's 50 or 100. Might be even less. But it is a powerful tool.