# Active Directory Audit - Reporting and Alerting for Graylog

**URL:** <https://community.graylog.org/t/active-directory-audit-reporting-and-alerting-for-graylog/23039>\
**Category:** Other Solutions\
**Tags:** other\_solutions\
**Created:** [March 14, 2022, 5:06pm UTC](https://community.graylog.org/t/active-directory-audit-reporting-and-alerting-for-graylog/23039 "2022-03-14T17:06:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dscryber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dscryber/32/14178_2.png) [@dscryber](https://community.graylog.org/u/dscryber)\
**Post date:** [March 14, 2022, 5:06pm UTC](https://community.graylog.org/t/active-directory-audit-reporting-and-alerting-for-graylog/23039/1 "2022-03-14T17:06:21Z")

</div>

# Active Directory Audit - Reporting and Alerting

@leftorbit23

[View on Github](https://github.com/leftorbit23/graylog-ad-audit)  
[Open Issues](https://github.com/leftorbit23/graylog-ad-audit/issues)  
[Stargazers](https://github.com/leftorbit23/graylog-ad-audit/stargazers)

## Description

This Powershell script can be scheduled to run either daily or as frequently as you like to report on changes in the Active Directory.

Disclaimer: It’s only configured to search for specific event ids, so there may be other critical events that are not captured.

## Prerequisites

- Graylog server
- Must be configured to collect logs from all Domain Controllers
- Graylog user
- User must have access to a stream that contains Domain Controller security events
- User’s timezone should be set to your local time
- PowerShell (Tested with version 4)
- Active Directory Module for Powershell
- Domain user to run the script with

---

<div class="post-metadata">

**Author:** ![DrunkMunki](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drunkmunki/32/13446_2.png) [@DrunkMunki](https://community.graylog.org/u/DrunkMunki)\
**Post date:** [November 16, 2022, 5:39am UTC](https://community.graylog.org/t/active-directory-audit-reporting-and-alerting-for-graylog/23039/2 "2022-11-16T05:39:39Z")

</div>

Although this was posted in March, there are some issues with the script which dont work, have raised the in the github page.  
Nick-C has done a Pull request updating the code (haven’t tested yet) [GitHub - Nick-C/graylog-ad-audit: A Powershell script that can query a Graylog server for changes to specified AD Groups and generate alert emails](https://github.com/Nick-C/graylog-ad-audit)

this script is very useful and would like to make sure its maintained \<3