{"id":19617,"date":"2023-08-28T11:47:44","date_gmt":"2023-08-28T15:47:44","guid":{"rendered":"https:\/\/kevinjustin.com\/blog\/?p=19617"},"modified":"2023-08-28T11:47:44","modified_gmt":"2023-08-28T15:47:44","slug":"ad-insight-reports","status":"publish","type":"post","link":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/","title":{"rendered":"AD insight reports"},"content":{"rendered":"
\"Need<\/a>
Need to audit AD? Use AD insight reports pack!<\/figcaption><\/figure>\n

Download the ‘AD insights pack’ for new capabilities to audit users, svc\/MSA accounts, password last set, expiring, last login AD insights. Includes AD group audit alert capability.<\/p>\n

 <\/p>\n

Quick Download https:\/\/github.com\/theKevinJustin\/ADInsights\/<\/a><\/h4>\n

 <\/p>\n

 <\/p>\n

AD audit<\/h3>\n

Time to provide key ‘AD insight reports’ into users and groups.\u00a0 Delve into different AD audit capabilities for users and groups.\u00a0 The pack also gathers DC Security events (rules), and lastly, on demand tasks for reports.<\/p>\n

 <\/p>\n

The question is what determines a problem?<\/strong><\/p>\n

Every domain admin has a different experience and perspective, whether cyber (hack) focused or not.\u00a0 Audit standards differ, from HIPAA, SOX, CCRI, STIG, etc.<\/p>\n

Pack examples:<\/strong><\/p>\n

Users – service account naming conventions, password change frequency, expired date\/time configured.<\/p>\n

Groups – Choose your OU structure to audit WA in DA, SA in DA, WA in SA etc.<\/p>\n

NOTE: Take caution on the OU group audit, to limit the output, as events have a size limitation<\/span><\/p>\n

 <\/p>\n

Configure ‘AD insight reports’<\/strong><\/p>\n

Now we can configure the user pack for applicable standards, like password age, last set, or AppOwners.\u00a0 The AppOwners is an array, so you can add whatever Application, system owners\/teams in your organization.\u00a0 The password datasource (DS) rule runs weekly.<\/p>\n

\"Configure<\/a>
Configure the Password Time, last set, month, week and AppOwners to build out actionable svc\/msa accounts failing audit artifacts.<\/figcaption><\/figure>\n

 <\/p>\n

Break out the regular expressions of whatever accounts each team uses, to tailor relevant data into the report alert.\u00a0 Find\/Replace (Control-H) might be more effective, as the DS\/WA repeat the logic for the on-demand task report, vs. the rule and monitor.<\/p>\n

\"App<\/a>
App Owner relevant service accounts by SamAccountName<\/figcaption><\/figure>\n

 <\/p>\n

Update patterns ID naming conventions<\/strong><\/p>\n

Tailor account names to environment to match ingested DC Security events.<\/p>\n

\"Tailor<\/a>
Tailor the DC Security Events to account naming conventions.<\/figcaption><\/figure>\n

 <\/p>\n

Configure OU to environment<\/strong><\/p>\n

Configure OU structure to audit based on domain canonical names, groups, DC, etc.<\/p>\n

\"AD<\/a>
AD Group audit example<\/figcaption><\/figure>\n

 <\/p>\n

Save file(s) and import<\/p>\n","protected":false},"excerpt":{"rendered":"

Download the ‘AD insights pack’ for new capabilities to audit users, svc\/MSA accounts, password last set, expiring, last login AD insights. Includes AD group audit alert capability.   Quick Download https:\/\/github.com\/theKevinJustin\/ADInsights\/     AD audit Time to provide key ‘AD insight reports’ into users and groups.\u00a0 Delve into different AD audit capabilities for users and … Continue reading “AD insight reports”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[637,2,567,7,545,530],"tags":[21,677,26,639,678,679,624,342,680],"class_list":["post-19617","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-administration","category-authoring","category-mp-management-pack","category-powershell","category-scom","tag-ad","tag-ad-groups","tag-adds","tag-aduc","tag-get-adgroup","tag-get-adgroupmember","tag-powerbi","tag-scom","tag-scom-report"],"yoast_head":"\nAD insight reports - Kevin Justin's Blog<\/title>\n<meta name=\"description\" content=\"'AD insight reports' for auditing users, svc\/MSA accounts, password last set\/expiring\/last login, including AD OU\/group alert capabilities.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AD insight reports - Kevin Justin's Blog\" \/>\n<meta property=\"og:description\" content=\"'AD insight reports' for auditing users, svc\/MSA accounts, password last set\/expiring\/last login, including AD OU\/group alert capabilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/\" \/>\n<meta property=\"og:site_name\" content=\"Kevin Justin's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-28T15:47:44+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2023\/08\/ADInsight-scaled.jpg\" \/>\n<meta name=\"author\" content=\"WordPress Administrator\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"WordPress Administrator\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/\"},\"author\":{\"name\":\"WordPress Administrator\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/3d7a90f4430bef43134eaa0a7e2cd508\"},\"headline\":\"AD insight reports\",\"datePublished\":\"2023-08-28T15:47:44+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/\"},\"wordCount\":377,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/ADInsight-scaled.jpg\",\"keywords\":[\"AD\",\"AD groups\",\"ADDS\",\"ADUC\",\"get-adgroup\",\"get-adgroupmember\",\"PowerBI\",\"SCOM\",\"SCOM report\"],\"articleSection\":[\"Active Directory\",\"Administration\",\"Authoring\",\"MP Management Pack\",\"PowerShell\",\"SCOM\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/\",\"name\":\"AD insight reports - Kevin Justin's Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/ADInsight-scaled.jpg\",\"datePublished\":\"2023-08-28T15:47:44+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/3d7a90f4430bef43134eaa0a7e2cd508\"},\"description\":\"'AD insight reports' for auditing users, svc\\\/MSA accounts, password last set\\\/expiring\\\/last login, including AD OU\\\/group alert capabilities.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/ADInsight-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/08\\\/ADInsight-scaled.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/2023\\\/08\\\/28\\\/ad-insight-reports\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AD insight reports\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/\",\"name\":\"Kevin Justin's Blog\",\"description\":\"Operational monitoring tools including System Center, Azure Monitor\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/#\\\/schema\\\/person\\\/3d7a90f4430bef43134eaa0a7e2cd508\",\"name\":\"WordPress Administrator\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fca865cc5df90a25ae9533b1d9dea567a78c7469dc3202a376c8d117a0eaea11?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fca865cc5df90a25ae9533b1d9dea567a78c7469dc3202a376c8d117a0eaea11?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/fca865cc5df90a25ae9533b1d9dea567a78c7469dc3202a376c8d117a0eaea11?s=96&d=mm&r=g\",\"caption\":\"WordPress Administrator\"},\"sameAs\":[\"https:\\\/\\\/kevinjustin.com\"],\"url\":\"https:\\\/\\\/kevinjustin.com\\\/blog\\\/author\\\/wordpress_admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AD insight reports - Kevin Justin's Blog","description":"'AD insight reports' for auditing users, svc\/MSA accounts, password last set\/expiring\/last login, including AD OU\/group alert capabilities.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/","og_locale":"en_US","og_type":"article","og_title":"AD insight reports - Kevin Justin's Blog","og_description":"'AD insight reports' for auditing users, svc\/MSA accounts, password last set\/expiring\/last login, including AD OU\/group alert capabilities.","og_url":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/","og_site_name":"Kevin Justin's Blog","article_published_time":"2023-08-28T15:47:44+00:00","og_image":[{"url":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2023\/08\/ADInsight-scaled.jpg","type":"","width":"","height":""}],"author":"WordPress Administrator","twitter_card":"summary_large_image","twitter_misc":{"Written by":"WordPress Administrator","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#article","isPartOf":{"@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/"},"author":{"name":"WordPress Administrator","@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/3d7a90f4430bef43134eaa0a7e2cd508"},"headline":"AD insight reports","datePublished":"2023-08-28T15:47:44+00:00","mainEntityOfPage":{"@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/"},"wordCount":377,"commentCount":0,"image":{"@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#primaryimage"},"thumbnailUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2023\/08\/ADInsight-scaled.jpg","keywords":["AD","AD groups","ADDS","ADUC","get-adgroup","get-adgroupmember","PowerBI","SCOM","SCOM report"],"articleSection":["Active Directory","Administration","Authoring","MP Management Pack","PowerShell","SCOM"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/","url":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/","name":"AD insight reports - Kevin Justin's Blog","isPartOf":{"@id":"https:\/\/kevinjustin.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#primaryimage"},"image":{"@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#primaryimage"},"thumbnailUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2023\/08\/ADInsight-scaled.jpg","datePublished":"2023-08-28T15:47:44+00:00","author":{"@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/3d7a90f4430bef43134eaa0a7e2cd508"},"description":"'AD insight reports' for auditing users, svc\/MSA accounts, password last set\/expiring\/last login, including AD OU\/group alert capabilities.","breadcrumb":{"@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#primaryimage","url":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2023\/08\/ADInsight-scaled.jpg","contentUrl":"https:\/\/kevinjustin.com\/blog\/wp-content\/uploads\/2023\/08\/ADInsight-scaled.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/kevinjustin.com\/blog\/2023\/08\/28\/ad-insight-reports\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kevinjustin.com\/blog\/"},{"@type":"ListItem","position":2,"name":"AD insight reports"}]},{"@type":"WebSite","@id":"https:\/\/kevinjustin.com\/blog\/#website","url":"https:\/\/kevinjustin.com\/blog\/","name":"Kevin Justin's Blog","description":"Operational monitoring tools including System Center, Azure Monitor","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kevinjustin.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/kevinjustin.com\/blog\/#\/schema\/person\/3d7a90f4430bef43134eaa0a7e2cd508","name":"WordPress Administrator","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/fca865cc5df90a25ae9533b1d9dea567a78c7469dc3202a376c8d117a0eaea11?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/fca865cc5df90a25ae9533b1d9dea567a78c7469dc3202a376c8d117a0eaea11?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/fca865cc5df90a25ae9533b1d9dea567a78c7469dc3202a376c8d117a0eaea11?s=96&d=mm&r=g","caption":"WordPress Administrator"},"sameAs":["https:\/\/kevinjustin.com"],"url":"https:\/\/kevinjustin.com\/blog\/author\/wordpress_admin\/"}]}},"_links":{"self":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/19617","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/comments?post=19617"}],"version-history":[{"count":8,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/19617\/revisions"}],"predecessor-version":[{"id":19902,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/posts\/19617\/revisions\/19902"}],"wp:attachment":[{"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/media?parent=19617"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/categories?post=19617"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kevinjustin.com\/blog\/wp-json\/wp\/v2\/tags?post=19617"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}