Powershell Command to show renamed AD object?

Question

I'm trying to find out which AD objects have been renamed in AD through either UI or power shell command.

Thanks

Answer 1

Hi，

You have to enable auditing on the AD objects you want to monitor then the activities will be recorded in the Security Event Log. You may refer to the links below for more details.

AD DS Auditing Step-by-Step Guide
How to enable auditing of AD objects
How to Enable the Security Auditing of Active Directory

Once the events have been logged you can parse the Security Event Log. Suppose you want to get the AD objects renamed after 2021-04-05 20:30, then you can do something like this.

$date = "2021-04-05 20:30"  
$AttributeGuid = 'bf967a0e-0de6-11d0-a285-00aa003049e2' # Attribute Name  
$AccessId = '7685' # Write Property  
$ADObjects = @()  
Get-EventLog -LogName security -After $date -InstanceId 4662 | where-object {$_.Message -match $AttributeGuid -and $_.Message -match $AccessId }|   
    ForEach-Object {  
        $_.Message -match '(?<=Object Name:[\s]+%{)[-\w]+(?=})' | Out-Null  
        $ADObjects += Get-ADObject -Identity $Matches[0]  
    }  
$ADObjects  

Best Regards,
Ian Xue

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Take a look of DirSync API

https://www.msxfaq.de/exchange/tools/privat/get-adchanges.htm