Windows Active Directory (AD) Monitoring

By leveraging PowerShell commands, we created a script that monitors Windows Active Directory Privileged users.

The script output will show you a variable with the total number of privileged users. In addition, you’ll find a table with the privileged AD users count listed by group membership.

The scripts use the WinRM protocol to access the Windows server.It has been validated and tested on Windows Server 2019 with PowerShell version 5.1.19041.2364.

Find this script in our examples library:

• windows_priviledged_users_count.js

You can customize it to fit your needs.

We have built a script to monitor the GPOs version on a Windows machine.

Use it to check if the GPO version changes and their modification.

The GPOs versions we monitor are:

• AD Version (User)
• SYSVOL Version (User)
• AD Version (Computer)
• SYSVOL Version (Computer)

The scripts use the WinRM protocol to access the Windows OS.It has been validated and tested on Windows 10 and Windows Server 2019 with PowerShell version 5.1.19041.2364.

Find the script in our examples library:

• windows_gpo_version.js

You can customize the drivers to fit your needs.

By leveraging PowerShell commands, we created a script to monitor the following Windows Security events:

• 4720: A user account was created
• 4722: A user account was enabled
• 4731: A security-enabled local group was created
• 4732: A member was added to a security-enabled local group
• 4649: A replay attack was detected
• 4741: A computer account was created
• 4625: An account failed to log on
• 4817: Audit settings on objects were changed
• 4947: A change has been made to Windows Firewall exception list. A rule was modified
• 4948: A change has been made to Windows Firewall exception list. A rule was deleted

The scripts use the WinRM protocol to access the Windows endpoint. It has been validated and tested on Windows 10 and Windows Server 2019 with PowerShell version 5.1.19041.2364.

Find this script in our examples library:

• windows_security_events.js

You can customize the drivers to fit your needs.

Use the pre-configured scripts to monitor and manage network-connected devices, cloud services, and web applications. By using standard network protocols, the scripts will allow you to retrieve valuable data and execute actions on the monitored devices and services.

Build or customize scripts according to your network monitoring needs.

Additionally, you can apply customized alerts on scripts to be notified when a specific event occurs.