Finding out the date when a member was added to a AD security group.

[Guest]

Hi,
I was wondering if Hyena can give details on when members of a group were added to the group. We need this for Sox, so if Hyena could do it, it would be excellent.
Thanks
Brian

[cmccullough]

Re: Finding out the date when a member was added to a AD security group.

AD has a WhenChanged attribute that you can view that would tell you the last time the groups were modified, but there doesn't appear to be anything that would give you the information for each member.

[Guest]

Re: Finding out the date when a member was added to a AD security group.

You would need to check the logs for the group to see when a member was added or removed.

Check this out: http://www.windowsecurity.com/pages/..._p.asp?id=1363

[kstanush]

Re: Finding out the date when a member was added to a AD security group.

That is a really good article. Hyena's new filtering and save options for event logs really comes in handy when viewing events like this.

[Guest]

Re: Finding out the date when a member was added to a AD security group.

Now I have barely touched the surface of what Hyena can do since I am currently evaluating it for a single purpose (WMI Lookups on every computer on the network).

Is Hyena capable of searching through the logs of all the DC's in the network at once? This sounds like a really great feature when trying to find the cause of account lockouts.. since the way we do it now is open up the logs on each computer.

I know I should probably do some searching through the docs but it's 11:30 at night, I'm lazy, and I thought it might be relevant to this topic somewhat

[kstanush]

Re: Finding out the date when a member was added to a AD security group.

If you multi-select computers in Hyena's right window, you can right click and select Events and select the event ID(s) to filter out/in. In v6.3, you have the option to save the filtering parameters as well.

We did find a minor formatting bug after the release in our new event filtering dialog that truncates some of the text, but this is just a display problem. You can also select multiple logs at the same time, but in your case, you probably only want the Security log.

If you just want the DCs, then you probably want to display either the DomainControllers contrainer or just double-click on the Domain Controllers object for the domain and then select all of the DCs and filter the events from there.

Let us know how this turns out.