Forum Discussion

dmarquesgn's avatar
dmarquesgn
Iron Contributor
Mar 28, 2022

Write custom field on user creation on AD

Hi,

 

I'm developing some scripts in order to have some visibility of some key issues within user creation.

So I have a powershell script that reads some information about the users created in a 7 day range and sends it over email for analysis. One detail I'm missing is about each new created user, who was it created by. I've searched a bit, and that's event 4720 registered on Security Event Log for each DC. The issue is that due to the amount of events being created, I only have about 3/4h of events on the security event log.

So to overcome this issue, what I considered was while creating the AD User, being able to use a custom field to write the creator user as well, so this way I would have all the information I need. Is this something possible?

 

Thanks

Active Directory
powershell

5 Replies

Sort By
  • Harm_Veenstra's avatar
    Harm_Veenstra
    MVP
    Mar 28, 2022

    dmarquesgn If you use a script to create the user (which you run as the admin account that you want to be registered)  you could add something like this:

      Set-ADUser  -Identity username -Add @{
    extensionAttribute1 = $env:username
  }

     

     

    • dmarquesgn's avatar
      dmarquesgn
      Iron Contributor
      Mar 28, 2022
      Hi,

      Thanks. I understand and that would be great. But in our organization, where we got about 20 people creating and managing users, it will be really difficult to implement such a huge change on the user creation and management process. Most of the team is still very dependent of the GUI tools.
      Do you see any other way?

      Thanks
      • LainRobertson's avatar
        LainRobertson
        Silver Contributor
        Mar 29, 2022

        dmarquesgn 

         

        If the people doing the creating are members of the "admin" groups (i.e. Enterprise Admins, Domain Admins or Administrators) then the following won't help you. But if you've gone down the best practice route of removing everyone and leveraging Active Directory delegation, read on.

         

        When a "non-admin" creates an object in Active Directory, the "owner" within the ACL (click the Advanced button in the Security tab to see the listed owner if you're not sure how/where to check this) is set to the creator's account. Ergo, you can report on the "owner" and the process is tool-agnostic (see caveat below about middleware.)

         

        If everyone's just been dumped in one of the "admin" groups, this won't work as when such people create objects, the "owner" value is set to "Domain Admins" instead of the person doing the creating.

         

        The caveat is middleware that performs the administration activities under its own process identity. That won't help with native reporting as outlined above but it's possible such products have their own internal reporting mechanisms you can leverage.

         

        Cheers,

        Lain

Resources