If you want to audit the Active Directory, this is the project you need :

Visit now the project page here

The resources used for this project are :

– LAMP server

– Microsoft Event Forwarder engine

– Bootstrap css/javascript

– Datatables JQuery Library

– Mysql for the event storage

Reference

Get-WinEvent

Gets events from event logs and event tracing log files on local and remote computers.

Get-WinEvent also lists event logs and event log providers. You can get events from selected logs or from logs generated by selected event providers. And, you can combine events from multiple sources in a single command.Get-WinEvent allows you to filter events by using XPath queries, structured XML queries, and simplified hash-table queries.

Without parameters, a Get-WinEvent command gets all the events from all the event logs on the computer. To interrupt the command, press CTRL + C.

The Get-WinEvent cmdlet gets events from event logs, including classic logs, such as the System and Application logs, and the event logs that are generated by the Windows Event Log technology introduced in Windows Vista. It also gets events in log files generated by Event Tracing for Windows (ETW).

-ComputerName

Gets events from the event logs on the specified computer. Type the NetBIOS name, an Internet Protocol (IP) address, or the fully qualified domain name of the computer. The default value is the local computer. This parameter accepts only one computer name at a time. To find event logs or events on multiple computers, use a ForEach statement. For more information about this parameter, see the examples. To get events and event logs from remote computers, the firewall port for the event log service must be configured to allow remote access. This cmdlet does not rely on Windows PowerShell remoting. You can use the ComputerName parameter even if your computer is not configured to run remote commands. Aliases none Required? false Position? named Default Value Local computer Accept Pipeline Input? false Accept Wildcard Characters? false

-Credential

Specifies a user account that has permission to perform this action. The default value is the current user. Type a user name, such as User01 or Domain01\User01. Or, enter a PSCredential object, such as one generated by the Get-Credential cmdlet. If you type a user name, you will be prompted for a password. If you type only the parameter name, you will be prompted for both a user name and a password. Aliases none Required? false Position? named Default Value Current user Accept Pipeline Input? false Accept Wildcard Characters? false

-FilterHashtable

Uses a query in hash table format to select events from one or more event logs. The query contains a hash table with one or more key-value pairs. Hash table queries have the following rules: — Keys and values are case-insensitive. — Wildcard characters are valid only in the values associated with the LogName and ProviderName keys. — Each key can be listed only once in each hash-table. — The Path value takes paths to .etl, .evt, and .evtx log files. — The LogName, Path, and ProviderName keys can be used in the same query. — The UserID key can take a valid security identifier (SID) or a domain account name that can be used to construct a valid System.Security.Principal.NTAccount object. — The Data value takes event data in an unnamed field. This is for events in classic event logs. — The * key represents a named event data field. When Get-WinEvent cannot interpret a key-value pair, it interprets the key as a case-sensitive name for the event data in the event. The valid key-value pairs are as follows: — LogName=

— ProviderName=

— Path=

— Keywords=

— ID=

— Level=

— StartTime=

— EndTime=

— UserID=

— Data=

— *= Aliases none Required? true Position? 1 Default Value none Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? false

-FilterXPath

Uses an XPath query to select events from one or more logs. For more information about the XPath language, see “XPath Reference” in the MSDN library at http://go.microsoft.com/fwlink/?LinkId=242509 and “Selection Filters” in “Event Selection” in the MSDN library athttp://go.microsoft.com/fwlink/?LinkId=242510. Aliases none Required? false Position? named Default Value None Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? false

-FilterXml

Uses a structured XML query to select events from one or more event logs. To generate a valid XML query, use the Create Custom View and Filter Current Log features in Event Viewer. Use the items in the dialog box to create a query, and then click the XML tab to view the query in XML format. You can copy the XML from the XML tab into the value of the FilterXml parameter. For more information about the Event Viewer features, see Event Viewer Help. Typically, you use an XML query to create a complex query that contains several XPath statements. The XML format also allows you to use a “Suppress” XML element that excludes events from the query. For more information about the XML schema for event log queries, see the following topics in the MSDN (Microsoft Developer Network) library. — “Query Schema”: http://go.microsoft.com/fwlink/?LinkId=143685 — “XML Event Queries” in “Event Selection”: http://go.microsoft.com/fwlink/?LinkID=143608 Aliases none Required? true Position? 1 Default Value None Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? false

-Force

Gets debug and analytic logs, in addition to other event logs. The Force parameter is required to get a debug or analytic log when the value of the name parameter includes wildcard characters. By default, Get-WinEvent excludes these logs unless you specify the full name of a debug or analytic log. Aliases none Required? false Position? named Default Value Debugging and analytic logs are not returned in response to queries that use wildcard characters. Accept Pipeline Input? false Accept Wildcard Characters? false

-ListLog

Gets the specified event logs. Enter the event log names in a comma-separated list. Wildcards are permitted. To get all the logs, enter a value of *. Aliases none Required? true Position? 1 Default Value None Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? true

-ListProvider

Gets the specified event log providers. An event log provider is a program or service that writes events to the event log. Enter the provider names in a comma-separated list. Wildcards are permitted. To get the providers of all the event logs on the computer, enter a value of *. Aliases none Required? true Position? 1 Default Value None Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? true

-LogName

Gets events from the specified event logs. Enter the event log names in a comma-separated list. Wildcards are permitted. You can also pipe log names to Get-WinEvent. Aliases none Required? false Position? 1 Default Value None Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? true

-MaxEvents

Specifies the maximum number of events that Get-WinEvent returns. Enter an integer. The default is to return all the events in the logs or files. Aliases none Required? false Position? named Default Value All events Accept Pipeline Input? true (ByValue, ByPropertyName) Accept Wildcard Characters? false

-Oldest

Returns the events in oldest-first order. By default, events are returned in newest-first order. This parameter is required to get events from .etl and .evt files and from debug and analytic logs. In these files, events are recorded in oldest-first order, and the events can be returned only in oldest-first order. Aliases none Required? false Position? named Default Value False Accept Pipeline Input? false Accept Wildcard Characters? false

-Path

Gets events from the specified event log files. Enter the paths to the log files in a comma-separated list, or use wildcard characters to create file path patterns. Get-WinEvent supports files with the .evt, .evtx, and .etl file name extensions. You can include events from different files and file types in the same command. Aliases none Required? true Position? 1 Default Value None Accept Pipeline Input? true (ByPropertyName) Accept Wildcard Characters? true

-ProviderName

Gets events written by the specified event log providers. Enter the provider names in a comma-separated list, or use wildcard characters to create provider name patterns. An event log provider is a program or service that writes events to the event log. It is not a Windows PowerShell provider. Aliases none Required? true Position? 1 Default Value None Accept Pipeline Input? true (ByPropertyName) Accept Wildcard Characters? true