EvotecIT/PSWinReporting EvotecIT/PSWinReporting

  • Stars
    star
    704
  • Rank 64,316 (Top 2 %)
  • Language
    PowerShell
  • License
    MIT License
  • Created over 6 years ago
  • Updated 10 months ago
Twitter logo Share LinkedIn logo Share Facebook logo Share
EvotecIT/PSWinReporting
github

EvotecIT

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

This PowerShell Module has multiple functionalities, but one of the signature features of this module is the ability to parse Security logs on Domain Controllers providing easy to use access to AD Events.

PSWinReporting

PSWinReporting is a little PowerShell module that solves the problem of monitoring and reading Windows Events. It allows you to set up monitoring of Domain Controllers (and from 2.X any other servers) for events that happen on them. By default, it comes with built-in Active Directory events supports, but since 2.0 you can configure it to monitor anything. You can set up reporting on any types of events and have emails delivered with a summary of hourly, daily, weekly, monthly, or quarterly changes. It also supports sending notifications to Microsoft Teams, Slack, and Discord. Make sure to go thru related articles as they have all the KNOW HOW which is quite useful if you want to get everything from this module.

The full project description is available on my website - Full project description.

Currently, there are 2 branches of PSWinReporting.

  • Legacy branch - available in PS Gallery as PSWinReporting - Install-Module -Name 'PSWinReporting' -Force
  • Master branch - available in PS Gallery as PSWinReportingV2 - Install-Module -Name 'PSWinReportingV2' -Force

I've decided that both PowerShell modules can coexist together, especially for scenarios for people who want to switch, but don't want to do it right away. This way, you can keep using old version as is, and slowly fix your other stuff, or use new Find-Events command. I've slightly renamed the commands for V2 release.

PSWinReportingV2 - Master Edition

Master edition is a complete rewrite and a new beginning. It provides the same functionality as Legacy 1.X version and then some more.

  • Ability to translate report and have it suite your needs
  • Ability to completely modify events monitoring
  • Ability to monitor any servers, for any events using simple to use schema
  • Ability to target multiple servers, computers or files at the same time

At this moment there is no documentation for PSWinReportingV2 except for those articles below. Feel free to explore Examples if you're eager to try the new version — otherwise fallback to PSWinReporting Legacy Edition.

Built-in Active Directory Reports

PSWinReporting comes with predefined, built-in reports. Those are for Find-Events. Those also come defined in example configuration script which you can use straight away after verifying everything is as per your requirement.

  • ADComputerChangesDetailed
  • ADComputerCreatedChanged
  • ADComputerDeleted
  • ADGroupChanges
  • ADGroupChangesDetailed
  • ADGroupCreateDelete
  • ADGroupEnumeration
  • ADGroupMembershipChanges
  • ADGroupPolicyChanges
  • ADLogsClearedOther
  • ADLogsClearedSecurity
  • ADUserChanges
  • ADUserChangesDetailed
  • ADUserLockouts
  • ADUserLogon
  • ADUserLogonKerberos
  • ADUserStatus
  • ADUserUnlocked
  • ADOrganizationalUnitChangesDetailed (added in 2.0.10)
  • OSStartupShutdownCrash (added in 2.0.12) - covers startup, shutdown and crashes - probably needs some work on the engine later on to allow field merging
  • OSCrash (added in 2.0.12) - covers system crashes
  • NetworkAccessAuthenticationPolicy (added in 2.0.12) - covers authorizations approved/denied for WIFI and ETHERNET

Built-in Reporting Times

PSWinReporting comes with predefined report times. This means you can use True/False to enable/disable period. In case of Find-Events, you can use defined times (checked only) from DatesRange parameter.

  • CurrentDay
  • CurrentDayMinusDayX
  • CurrentDayMinuxDaysX
  • CurrentHour
  • CurrentMonth
  • CurrentQuarter
  • CustomDate
  • Everything
  • Last14days
  • Last3days
  • Last7days
  • OnDay
  • PastDay
  • PastHour
  • PastMonth
  • PastQuarter

Of course, you can also define DateFrom, DateTo parameters for custom use when using Find-Events command.

PSWinReporting - Legacy Edition

Legacy edition will continue it's life as 1.X.X. If you want to keep on using it, feel free, but it's highly encouraged to use 2.x.x when it's fully functional with all features. Code is available as Legacy Branch. Following links can help in understanding how it works and how to set it up:

Following AD Events are supported:

  • Group create, delete, modify (Who / When / What)
  • Group membership changes (Who / When / What)
  • User changes (Who / When / What)
  • User created / deleted (Who / When)
  • User password changes (Who / When)
  • User lockouts (Who / When / Where)
  • Computer Created / Modified (Who / When / Where)
  • Computer Deleted (Who / When / Where)
  • Event Log Backup (Who / When)
  • Event Log Clear (Who / When)

Features:

  • Support for Event Forwarding - monitoring one event log instead of scanning all domain controllers
  • Support for Microsoft Teams - Sending events as they happen to Microsoft Teams (only supported when forwarders are in use)
  • Support for Slack - Sending events as they happen to Slack (only supported when forwarders are in use)
  • Support for Microsoft SQL - Sending events directly to SQL (some people prefer it that way)
  • Support for backing up old archived logs (moves logs from Domain Controllers into chosen place)
  • Support for re-scanning logs from files - a way to recheck your logs for missing information

Example - Script running

image

Example - Email Report

image

Example - Microsoft Teams

image

Example - Slack

image

More Repositories

1

GPOZaurr

Group Policy Eater is a PowerShell module that aims to gather information about Group Policies but also allows fixing issues that you may find in them.
PowerShell
847
star
2

PSWriteHTML

PSWriteHTML is PowerShell Module to generate beautiful HTML reports, pages, emails without any knowledge of HTML, CSS or JavaScript. To get started basics PowerShell knowledge is required.
PowerShell
816
star
3

Testimo

Testimo is a PowerShell module for running health checks for Active Directory against a bunch of different tests
PowerShell
527
star
4

ADEssentials

PowerShell Active Directory helper functions to manage healthy Active Directory
PowerShell
425
star
5

PSTeams

PSTeams is a PowerShell Module working on Windows / Linux and Mac. It allows sending notifications to Microsoft Teams via WebHook Notifications. It's pretty flexible and provides a bunch of options. Initially, it only supported one sort of Team Cards but since version 2.X.X it supports Adaptive Cards, Hero Cards, List Cards, and Thumbnail Cards. All those new cards have their own cmdlets and the old version of creating Teams Cards stays as-is for compatibility reasons.
PowerShell
408
star
6

OfficeIMO

Fast and easy to use cross-platform .NET library that creates or modifies Microsoft Word (DocX) and later also Excel (XLSX) files without installing any software. Library is based on Open XML SDK
C#
279
star
7

PSWinDocumentation

PowerShell Module that creates Word/Excel/SQL documentation from Active Directory (AD), AWS, Office 365 and others. It's a work in progress!
PowerShell
243
star
8

PSWriteWord

PSWriteWord is powershell module to create Microsoft Word documents without Microsoft Word installed...
PowerShell
229
star
9

PSSharedGoods

PSSharedGoods is little PowerShell Module that primary purpose is to be useful for multiple tasks, unrelated to each other. I've created this module as “a glue” between my other modules.
PowerShell
212
star
10

PSWritePDF

PowerShell Module to create, edit, split, merge PDF files on Windows / Linux and MacOS
PowerShell
187
star
11

PSWriteColor

Write-Color is a wrapper around Write-Host allowing you to create nice looking scripts, with colorized output.
PowerShell
163
star
12

Mailozaurr

Mailozaurr is a PowerShell module that aims to provide SMTP, POP3, IMAP and probably some other ways to interact with Email. Underneath it uses MimeKit and MailKit libraries written by Jeffrey Stedfast.
PowerShell
146
star
13

O365Essentials

A module that helps to manage some tasks on Office 365/Azure via undocumented API
PowerShell
124
star
14

PSWinDocumentation.AD

PowerShell module delivering a lot of Active Directory Forest/Domain information
PowerShell
121
star
15

PSEventViewer

PSEventViewer (Get-Events) is really useful PowerShell wrapper around Get-WinEvent. One of the features you may be interested in is a simple way of getting “hidden” events data
C#
105
star
16

Dashimo

Dashimo is very simple, intuitive PowerShell generated HTML file. That's right. A single, static HTML file that you can send to email or host on a website.
HTML
105
star
17

PSWriteOffice

Experimental PowerShell Module to create and edit Microsoft Word, Microsoft Excel, and Microsoft PowerPoint documents without having Microsoft Office installed.
PowerShell
104
star
18

PowerBGInfo

PowerBGInfo is a PowerShell module that is used to generate background information for Windows machines. It's a replacement for BGInfo that doesn't require installation and is much more flexible.
PowerShell
103
star
19

PasswordSolution

This module allows the creation of password expiry emails for users, managers, administrators, and security according to defined templates. It's able to work with different rules allowing to fully customize who gets the email and when.
PowerShell
101
star
20

Statusimo

PowerShell Generated Status Page
PowerShell
95
star
21

PSParseHTML

PSParseHTML is PowerShell module that's main purpose is to be a helper module for PSWriteHTML. However it's functionality can be utilized in other projects, not related to PSWriteHTML, therefore it's available as a separate module.
PowerShell
71
star
22

PSAutomator

This PowerShell Module is new approach to onboarding, offboarding and business as usual processes running in companies infrastructure.
PowerShell
67
star
23

ImagePlayground

ImagePlayground is a PowerShell module that provides a set of functions for image processing. Among other things it can create QRCodes, BarCodes, Charts, and do image processing that can help with daily tasks.
C#
66
star
24

Emailimo

Small project that simplifies (according to me) sending colorful emails in PowerShell
PowerShell
64
star
25

PSWriteExcel

PSWriteExcel is very basic (at the moment) PowerShell module to create Microsoft Excel workbooks without Microsoft Excel installed.
PowerShell
61
star
26

CleanupMonster

This module provides an easy way to cleanup Active Directory from dead/old objects based on various criteria. It can also disable, move or delete objects. It can utilize Azure AD, Intune and Jamf to get additional information about objects before deleting them.
PowerShell
60
star
27

PSPGP

PSPGP is a PowerShell module that provides PGP functionality in PowerShell. It allows encrypting and decrypting files/folders and strings using PGP.
PowerShell
55
star
28

Transferetto

Small PowerShell module with FTPS/SFTP functionality
PowerShell
55
star
29

PSBlackListChecker

Basic functionality of this module is ability to quickly verify if given IP address is on any of over 80 defined DNSBL lists. Below code will return results only if IP is on any of the lists. Advanced functionality of this module is ability to send reports to your email when things get bad on one of those 80 defined DNSBL listrs.
PowerShell
55
star
30

PSDiscord

Simple PowerShell module allowing to send messages to Discord Channel over webhooks
PowerShell
47
star
31

PowerShellManager

Little PowerShell module to extract PowerShell scripts that no longer exists on disk but were run and are still in Event Logs.
PowerShell
40
star
32

PSPasswordExpiryNotifications

Following PowerShell Module provides different approach to scheduling password notifications for expiring Active Directory based accounts. While most of the scripts require knowledge on HTML... this one is just one config file and a bit of tingling around with texts. Whether this is good or bad it's up to you to decide. I do plan to add an option to use external HTML template if there will be requests for that.
PowerShell
39
star
33

PSLansweeper

PowerShell Module to interact with Lansweeper Database
TSQL
31
star
34

VirusTotalAnalyzer

PowerShell module that intearacts with the VirusTotal service using a VirusTotal API (free)
PowerShell
30
star
35

PSPublishModule

This module is a module builder helper that helps build PowerShell modules "Evotec way". It allows us to make sure our modules are built the same way every time making the process really easy to build and publish new versions.
PowerShell
28
star
36

PSWinDocumentation.O365HealthService

PSWinDocumentation.O365HealthService is a Powershell module that has a single goal of getting Office 365 Health Status
PowerShell
23
star
37

IISParser

IISParser is a PowerShell module to read IIS logs. It's very fast and easy to use. This module is based on IISLogParser library that does all the heavy lifting.
PowerShell
22
star
38

O365Synchronizer

O365Synchronizer is a PowerShell module that allows you to synchronize users/contacts to user mailboxes contact list. It can also be used to synchronize users between tenants as contacts or guests.
PowerShell
19
star
39

ConsoleMonster

ConsoleMonster is a PowerShell module to build cool GUI applications using Spectre Console and Terminal GUI.
PowerShell
18
star
40

DesktopManager

DesktopManager is a C# library and PowerShell module that allows to get and set wallpapers to given monitor.
PowerShell
15
star
41

UnifiStockTracker

UnifiStockTracker is a PowerShell module to get current stock on Europe, Brazil or USA Ubiquiti stores. Since I was constantly checking stock on Ubiquiti store waiting for specific products I decided to automate it.
PowerShell
14
star
42

PSWebToolbox

Simple PowerShell Module to get RSS feeds
PowerShell
13
star
43

SecurityPolicy

Provides a way to configure user rights assignments in local security policies using PowerShell without using secedit.exe.
PowerShell
13
star
44

Documentimo

This PowerShell module allows you to create Microsoft Word documents without Word being installed on the machine
PowerShell
13
star
45

Connectimo

PowerShell
11
star
46

PSOutlookProfile

Tool to manage (to some degree) Outlook Profile in PowerShell
PowerShell
10
star
47

DnsClientX

DnsClientX is an async C# library for DNS over UDP, TCP, HTTPS (DoH), and TLS (DoT). It also has a PowerShell module that can be used to query DNS records. It provides a simple way to query DNS records using multiple DNS providers. It supports multiple DNS record types and parallel queries.
C#
10
star
48

PSPulsewayManager

Following is an easy to use Powershell module to control some of Pulseway Manager functionality. While Pulseway Manager offers GUI for enterprise deployments configuring some things from GUI is time consuming and not always easy.
PowerShell
9
star
49

Excelimo

PowerShell
8
star
50

PSWinDocumentation.O365

PowerShell
8
star
51

PowerInfoblox

PowerInfoblox is a PowerShell module to interact with Infoblox service
PowerShell
7
star
52

Graphimo

Small PowerShell module that helps with Microsoft GraphApi calls. It's a legacy module that I still use across some of my code bases. Shouldn't be used for new deployments
PowerShell
6
star
53

PSMyPassword

This little PowerShell module provides a simple way to change password of any user account if you know it. This is very useful for situations when you can't login to RDP
PowerShell
6
star
54

PSFreshService

PowerShell Module to control FreshService via their api (https://freshservice.com/)
PowerShell
6
star
55

PSWinDocumentation.DNS

PowerShell
5
star
56

PSWinDocumentation.AzureHealthService

PowerShell module that helps providing Azure Health as PowerShell data.
PowerShell
5
star
57

AuditPolicy

AuditPolicy module aims to replace auditpol.exe to get or set Auditing Policies in Windows in more native PowerShell way
PowerShell
5
star
58

PowerFederatedDirectory

PowerFederatedDirectory is a PowerShell module to interact with service https://www.federated.directory/. This module uses API exposed by Federated Directory and allows to Add, Get, Set and Remove users from Federated Directory.
PowerShell
5
star
59

LittleInfrastructureManager

PowerShell
5
star
60

DelegationModel

DelegationModel PowerShell module provides a simplified way to manage delegation in Active Directory. It's based on ADEssentials module and builts on top of it.
PowerShell
5
star
61

LocalSecurityEditor

.NET library for managing local security policy (User Rights Assignment).
C#
4
star
62

PSWinDocumentation.AWS

PSWinDocumentation.AWS is a PowerShell module that has a single goal of getting AWS Information
PowerShell
4
star
63

PSUnifi

PowerShell
4
star
64

DomainDetective

Domain Detective is a C# library, Tool and PowerShell module in one project. It is designed to help you find interesting information about a domain name.
C#
4
star
65

MarkdownPrince

PowerShell module that helps converting HTML files into Markdown
PowerShell
4
star
66

evotecit.github.io

HTML
3
star
67

PSWinDocumentation.DHCP

PowerShell
3
star
68

homebridge-siegenia

Small homebridge plugin supporting Siegenia Windows
TypeScript
3
star
69

PSFilePermissions

PowerShell
3
star
70

O365EmailAddressPolicy

O365EmailAddressPolicy PowerShell module replicates Exchange On-Premise functionality when it comes to Email Address Policy allowing cloud-only environments. Office 365 doesn't provide an option to autogenerate email addresses for users. This module enables the creation of email addresses for users based on their first name and last name.
PowerShell
3
star
71

TheDashboard

TheDashboard is a PowerShell module that generates nice HTML dashboard that's main goal is to integrate multiple reports created by other PowerShell modules. It's main goal is to provide a single place to see all the information you need. It's not meant to be a replacement for other modules.
PowerShell
3
star
72

PSWordPress

PSWordPress is PowerShell Module that allows interacting with WordPress using PowerShell via Rest API. It allows to list, create, edit or remove posts, pages, etc.
PowerShell
2
star
73

PSManageService

Proof of concept for reading services (Get-Service -ComputerName -Name ) with runspaces (parallel processing)
PowerShell
2
star
74

PSWindowsUpdates

PowerShell
2
star
75

CDN

This is a support project for PSWriteHTML to be able to provide CDN functionality for its own code, or code modified for PSWriteHTML needs.
JavaScript
2
star
76

PSWinDocumentation.Azure

PowerShell
2
star
77

PSDevSummary

PowerShell
2
star
78

PSWriteHTML.Maps

PSWriteHTML.Maps is an example plugin/extension to PSWriteHTML that adds ability to display MAPS in PSWriteHTML reports. This is proof of concept and good example for adding a single functionality to PSWriteHTML.
PowerShell
2
star
79

DbaClientX

DbaClientX is a small PowerShell module that allows running queries against Sql Server
PowerShell
2
star
80

PSWinDocumentation.ADConnect

1
star
81

PSWinDocumentation.Exchange

PowerShell
1
star
82

PowerQualys

PowerQualys is a PowerShell module to interact with Qualys API in easy and efficient way
PowerShell
1
star
83

PowerShellRunFromCSharp

This is demo project for testing things out as I need and when I need. Nothing to see here :-)
C#
1
star
84

PowerShellBinaryDemo

This is demo project for testing things out as I need and when I need. Nothing to see here :-)
C#
1
star
85

HtmlForgeX

HtmlForgeX is a .NET library that simplifies the creation of HTML documents, pages and reports. It provides a fluent API to create HTML / CSS / JavaScript without knowing any of it. It is designed to be simple and easy to use, and to provide a way to create HTML content in a more readable and maintainable way.
C#
1
star