Closed Cool34000 closed 2 years ago
Hi,
Group names should be retrieved from their known SIDs.
# Users/Groups SIDs $AdministratorSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-500" $DomainAdminsSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-512" $DomainUsersSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-513" $DomainControllersSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-516" $SchemaAdminsSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-518" $EnterpriseAdminsSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-519" $ProtectedUsersSID = ((Get-ADDomain -Current LoggedOnUser).domainsid.value)+"-525" EveryOneSID = New-Object System.Security.Principal.SecurityIdentifier "S-1-1-0" $AuthenticatedUsersSID = New-Object System.Security.Principal.SecurityIdentifier "S-1-5-11" # Users/Groups real names $Administrators = (Get-AD -Identity S-1-5-32-544).SamAccountName $Users = (Get-AD -Identity S-1-5-32-545).SamAccountName $Administrator = (Get-AD -Identity $AdministratorSID).SamAccountName $DomainAdmins = (Get-AD -Identity $DomainAdminsSID).SamAccountName $DomainUsers = (Get-AD -Identity $DomainUsersSID).SamAccountName $DomainControllers = (Get-AD -Identity $DomainControllersSID).SamAccountName $SchemaAdmins = (Get-AD -Identity $SchemaAdminsSID).SamAccountName $EnterpriseAdmins = (Get-AD -Identity $EnterpriseAdminsSID).SamAccountName $ProtectedUsers = (Get-AD -Identity $ProtectedUsersSID).SamAccountName $EveryOne = $EveryOneSID.Translate([System.Security.Principal.NTAccount]).Value $AuthenticatedUsers = $AuthenticatedUsersSID.Translate([System.Security.Principal.NTAccount]).Value
Using these variables, I was able to make it work on a French version of Active Directory. Don't know how to send the modified version up here...
Update AdAudit.ps1 #20
Fixed by @Cool34000 Many thanks
Hi,
Group names should be retrieved from their known SIDs.
Using these variables, I was able to make it work on a French version of Active Directory. Don't know how to send the modified version up here...