教程 Powershell - 谁在域上创建了用户

是否要了解如何使用 Powershell 筛选 Windows 事件日志以查找谁在域上创建了用户帐户？在本教程中，我们将向您展示如何查找谁在Active Directory上创建了帐户。

• Windows 2012 R2
• Windows 2016
• Windows 2019
• 视窗 2022
• Windows 10
• 视窗 11

设备列表

在这里，您可以找到用于创建本教程的设备列表。

设备列表

此链接还将显示用于创建本教程的软件列表。

教程 Powershell - 谁在域上创建了用户

在域控制器上，启动提升的 Powershell 命令行。

列出与创建用户帐户相关的事件。

Copy to Clipboard

下面是命令输出。

Copy to Clipboard

显示与创建用户帐户相关的事件内容。

Copy to Clipboard

下面是命令输出。

Copy to Clipboard

Message              : A user account was created.

Subject:
                        Security ID:            S-1-5-21-4215187987-3124207031-433979976-500
                        Account Name:           administrator
                        Account Domain:         TECH
                        Logon ID:               0x92491

New Account:
                        Security ID:            S-1-5-21-4215187987-3124207031-433979976-1106
                        Account Name:           vegeta
                        Account Domain:         TECH

Attributes:
                        SAM Account Name:       vegeta
                        Display Name:           Prince Vegeta
                        User Principal Name:    vegeta@TECH.LOCAL
                        Home Directory:         -
                        Home Drive:             -
                        Script Path:            -
                        Profile Path:           -
                        User Workstations:      -
                        Password Last Set:      <never>
                        Account Expires:                <never>
                        Primary Group ID:       513
                        Allowed To Delegate To: -
                        Old UAC Value:          0x0
                        New UAC Value:          0x15
                        User Account Control:
                                Account Disabled
                                'Password Not Required' - Enabled
                                'Normal Account' - Enabled
                        User Parameters:        -
                        SID History:            -
                        Logon Hours:            <value not set>

Additional Information:
                        Privileges              -
Id                   : 4720
Version              : 0
Qualifiers           :
Level                : 0
Task                 : 13824
Opcode               : 0
Keywords             : -9214364837600034816
RecordId             : 123413
ProviderName         : Microsoft-Windows-Security-Auditing
ProviderId           : 54849625-5478-4994-a5ba-3e3b0328c30d
LogName              : Security
ProcessId            : 824
ThreadId             : 3200
MachineName          : TECH-DC01.TECH.LOCAL
UserId               :
TimeCreated          : 8/9/2022 4:01:18 AM
ActivityId           :
RelatedActivityId    :
ContainerLog         : Security
MatchedQueryIds      : {}
Bookmark             : System.Diagnostics.Eventing.Reader.EventBookmark
LevelDisplayName     : Information
OpcodeDisplayName    : Info
TaskDisplayName      : User Account Management
KeywordsDisplayNames : {Audit Success}
Properties           : {System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventProperty,
                       System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventProperty...}

仅显示事件消息的内容。

Copy to Clipboard

下面是命令输出。

Copy to Clipboard

A user account was created.

Subject:
        Security ID:            S-1-5-21-4215187987-3124207031-433979976-500
        Account Name:           administrator
        Account Domain:         TECH
        Logon ID:               0x92491

New Account:
        Security ID:            S-1-5-21-4215187987-3124207031-433979976-1106
        Account Name:           vegeta
        Account Domain:         TECH

Attributes:
        SAM Account Name:       vegeta
        Display Name:           Prince Vegeta
        User Principal Name:    vegeta@TECH.LOCAL
        Home Directory:         -
        Home Drive:             -
        Script Path:            -
        Profile Path:           -
        User Workstations:      -
        Password Last Set:      <never>
        Account Expires:                <never>
        Primary Group ID:       513
        Allowed To Delegate To: -
        Old UAC Value:          0x0
        New UAC Value:          0x15
        User Account Control:
                Account Disabled
                'Password Not Required' - Enabled
                'Normal Account' - Enabled
        User Parameters:        -
        SID History:            -
        Logon Hours:            <value not set>

Additional Information:
        Privileges              -

查找过去 30 天内创建用户帐户的用户。

Copy to Clipboard

列出与创建特定用户帐户相关的事件。

Copy to Clipboard

在我们的示例中，我们根据事件消息内容进行筛选。

祝贺！您可以使用Powershell找到谁在Active Directory中创建了用户帐户。

Powershell - 谁在域上创建了用户

Powershell - 谁在域上创建了用户

设备列表

相关教程 - 电源壳

教程 Powershell - 谁在域上创建了用户

Related Posts