Using PowerShell to Discover Who Added a Client to Your Domain

Home > Videos > PowerShell > Using PowerShell to Discover Who Added a Client to Your Domain

Added by Jason Yoder March 7, 2017

In this video, PowerShell instructor Jason Yoder shows how to use PowerShell to quickly find who added a new client to your domain.

For instructor-led PowerShell courses, see our course schedule.

Microsoft Windows PowerShell Training

Download the PowerShell script used in this video.

<#
╔══════════════════════════════════════════════════════════════════════════════╗
║                                                                              ║		  
║                Discovering Who Added a Client to Your Domain                 ║
╟──────────────────────────────────────────────────────────────────────────────╢
║	                       Interface Technical Training                        ║
║	                             Jason A Yoder                                 ║
║	                                                                           ║
╚══════════════════════════════════════════════════════════════════════════════╝
#>

# ms-DS-MachineAccountQuota Documentation
Start-Process -FilePath "https://msdn.microsoft.com/en-us/library/ms678639(v=vs.85).aspx"


# List the current value of ms-DS-MachineAccountQuota
Get-ADDomain | 
    Select-Object -ExpandProperty DistinguishedName | 
    Get-ADObject -Properties 'ms-DS-MachineAccountQuota' | 
    Select-Object -ExpandProperty ms-DS-MachineAccountQuota


# Join a client to the domain as DWilliams (Diane Williams)

# List the most recently joined client to the domain
Get-ADComputer -Filter * | Select-Object -Last 1

# Check for all computer objects with an ms-DS-CreatorSid populated.
Get-ADComputer -Properties ms-ds-CreatorSid -Filter {ms-ds-creatorsid -ne "$Null"}

# ms-DS-CreatorSid Documentation
Start-Process -FilePath "https://msdn.microsoft.com/en-us/library/ms678637(v=vs.85).aspx"

# Number clients and users in this environment
Get-ADComputer -Filter * | Measure-Object | Select-Object -ExpandProperty Count
Get-ADUser -Filter * | Measure-Object | Select-Object -ExpandProperty Count

# Assuming it takes 10 seconds to evaluate all of the records (In Days).
((10 * (Get-ADComputer -Filter * | Measure-Object | Select-Object -ExpandProperty Count)) + (10 * (Get-ADUser -Filter * | Measure-Object | Select-Object -ExpandProperty Count)))/60/60/24


# Who did this?
$Clients = Get-ADComputer -Properties ms-ds-CreatorSid, WhenCreated -Filter {ms-ds-creatorsid -ne "$Null"}
$Users = Get-ADUser -Filter *

ForEach ($C in $Clients)
    {
        ForEach ($U in $Users) 
        {
            If ($U.Sid -eq $C.'ms-ds-creatorsid')
            {
                $C | Select-Object -Property @{
                        Name = 'ComputerName'; Expression = {$C.Name}},
                        @{Name = 'WhenCreated'; Expression = {$C.WhenCreated.DateTime}},
                        @{Name = "UserName"; Expression = {$U.Name}
                    }
            }
        }
    }

# Get the ms-DS-MachineAccountQuota object from Active Directory.
$Attribute = Get-ADDomain | 
    Select-Object -ExpandProperty DistinguishedName | 
    Get-ADObject -Properties 'ms-DS-MachineAccountQuota'

# Expand the attribute.
$Attribute

# Replace the value of ms-DS-MachineAccountQuota from 10 to 0.
Set-ADObject -Identity $Attribute.ObjectGUID -Replace @{'ms-DS-MachineAccountQuota' = 0}

# Validate the change.
Get-ADDomain | 
    Select-Object -ExpandProperty DistinguishedName | 
    Get-ADObject -Properties 'ms-DS-MachineAccountQuota'

╔══════════════════════════════════════════════════════════════════════════════╗

║ ║

║ Discovering Who Added a Client to Your Domain ║

╟──────────────────────────────────────────────────────────────────────────────╢

║ Interface Technical Training ║

║ Jason A Yoder ║

║ ║

╚══════════════════════════════════════════════════════════════════════════════╝

# ms-DS-MachineAccountQuota Documentation

Start-Process -FilePath "https://msdn.microsoft.com/en-us/library/ms678639(v=vs.85).aspx"

# List the current value of ms-DS-MachineAccountQuota

Get-ADDomain |

Select-Object -ExpandProperty DistinguishedName |

Get-ADObject -Properties 'ms-DS-MachineAccountQuota' |

Select-Object -ExpandProperty ms-DS-MachineAccountQuota

# Join a client to the domain as DWilliams (Diane Williams)

# List the most recently joined client to the domain

Get-ADComputer -Filter * | Select-Object -Last 1

# Check for all computer objects with an ms-DS-CreatorSid populated.

Get-ADComputer -Properties ms-ds-CreatorSid -Filter {ms-ds-creatorsid -ne "$Null"}

# ms-DS-CreatorSid Documentation

Start-Process -FilePath "https://msdn.microsoft.com/en-us/library/ms678637(v=vs.85).aspx"

# Number clients and users in this environment

Get-ADComputer -Filter * | Measure-Object | Select-Object -ExpandProperty Count

Get-ADUser -Filter * | Measure-Object | Select-Object -ExpandProperty Count

# Assuming it takes 10 seconds to evaluate all of the records (In Days).

((10 * (Get-ADComputer -Filter * | Measure-Object | Select-Object -ExpandProperty Count)) + (10 * (Get-ADUser -Filter * | Measure-Object | Select-Object -ExpandProperty Count)))/60/60/24

# Who did this?