Monitor Domain Admins & Administrators Group

Forums

My Profile

Inbox

Address Book

My Subscription

My Forums

Monitor Domain Admins & Administrators Group

Logged in as: Guest

arrSession:exec spGetSession 2,16,45300

	Active Users: There are 0 members and 0 guests.
	Users viewing this topic: none

Printable Version

All Forums >> [Scripting] >> Post a VBScript >> Monitor Domain Admins & Administrators Group
Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks!

Page: [1]

Message

<< Older Topic Newer Topic >>

Monitor Domain Admins & Administrators Group - 4/2/2007 1:15:20 AM

cjwallace

Posts: 491
Score: 0
Joined: 3/5/2005
From: United Kingdom
Status: offline

Hi guys.

Here is a script that will check the Domain Admins & Administrators group in Active Directory and if it detects a change will send an email.

I have this setup as task that runs every 30 minutes on one of my local DC's

Hope this helps someone at somepoint in time.

Option Explicit
Dim strWhenChanged, strLastChanged
Dim strLastDateFile, objFSO, objDateFile
Dim strDomainAdmsDN, strAdminsDN, objDomainAdms, objAdmins
Dim objEmail
Const ForReading = 1
Const ForWriting = 2
Const OpenAsASCII = 0
Const CreateIfNotExist = True

' Specify Distinguished Names of groups to monitor.
strDomainAdmsDN = "cn=Domain Admins,cn=Users,dc=withers,dc=net"
strAdminsDN = "cn=Administrators,cn=Builtin,dc=withers,dc=net"

' Specify file where last change date (in UTC) is saved.
strLastDateFile = "C:\Program Files\Withers\AD_Groups\LastDate.txt"

' Retrieve last change date.
Set objFSO = CreateObject("Scripting.FileSystemObject")
On Error Resume Next
Set objDateFile = objFSO.OpenTextFile(strLastDateFile, ForReading)
If (Err.Number <> 0) Then
On Error GoTo 0

' Assign default date.
strLastChanged = "1/1/2007 12:00:00 AM"
Else
On Error GoTo 0
strLastChanged = objDateFile.ReadLine
objDateFile.Close
End If

' Bind to Domain Admins group.
Set objDomainAdms = GetObject("LDAP://" & strDomainAdmsDN)

' Check if changed.
If (CDate(objDomainAdms.whenChanged) > CDate(strLastChanged)) Then

Set objEmail = CreateObject("CDO.Message")
objEmail.From = "[email=EU-IT-Systems@withersworldwide.com]EU-IT-Systems@withersworldwide.com[/email]"
objEmail.To = "[email=EU-IT-Systems@withersworldwide.com]EU-IT-Systems@withersworldwide.com[/email]"
objEmail.Subject = "URGENT - Change to Global Domain Admins Group" 
objEmail.Textbody = Join( Array( _
"****Automatic email****," _
, " "_
, "URGENT URGENT URGENT."_
, " "_
, "A change has been made to the Active Directory Domain Admins Group" _
, " "_
, "Please check this group Immediately as the change could be suspect or have been made in error"_
, " "_
, "If you are aware of the change please reply to everyone in this email to confirm this is a genuine change"_
, " "_
, " "_
, "Domain Admins group was changed " & objDomainAdms.whenChanged & " "_
, " "_
, "Regards"_
, " "_
, "European IT Systems"_
, "Withers LLP"_
, " "_
, " "_
, "[email=EU-IT-Systems@withersworldwide.com]EU-IT-Systems@withersworldwide.com[/email]"_
, " "_
, " "_
, " "_
, "Please contact the European IT Systems Team with any issues"_
, " "_
, " "_
, " " ), vbCrLf ) 
objEmail.Configuration.Fields.Item _
("[link=http://schemas.microsoft.com/cdo/configuration/sendusing]http://schemas.microsoft.com/cdo/configuration/sendusing[/link]") = 2
objEmail.Configuration.Fields.Item _
("[link=http://schemas.microsoft.com/cdo/configuration/smtpserver]http://schemas.microsoft.com/cdo/configuration/smtpserver[/link]") = _
"IP ADDRESS HERE"
objEmail.Configuration.Fields.Item _
("[link=http://schemas.microsoft.com/cdo/configuration/smtpserverport]http://schemas.microsoft.com/cdo/configuration/smtpserverport[/link]") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
End If

' Bind to Administrators group.
Set objAdmins = GetObject("LDAP://" & strAdminsDN)

' Check if changed.
If (CDate(objAdmins.whenChanged) > CDate(strLastChanged)) Then

Set objEmail = CreateObject("CDO.Message")
objEmail.From = "[email=EU-IT-Systems@withersworldwide.com]EU-IT-Systems@withersworldwide.com[/email]"
objEmail.To = "[email=EU-IT-Systems@withersworldwide.com]EU-IT-Systems@withersworldwide.com[/email]"
objEmail.Subject = "URGENT - Change to Global Administrator Group" 
objEmail.Textbody = Join( Array( _
"****Automatic email****," _
, " "_
, "URGENT URGENT URGENT."_
, " "_
, "A change has been made to the Active Directory Administrator Group" _
, " "_
, "Please check this group Immediately as the change could be suspect or have been made in error"_
, " "_
, "If you are aware of the change please reply to everyone in this email to confirm this is a genuine change"_
, " "_
, " "_
, "Administrators group changed " & objAdmins.whenChanged & " "_
, " "_
, "Regards"_
, " "_
, "European IT Systems"_
, "Withers LLP"_
, " "_
, " "_
, "[email=EU-IT-Systems@withersworldwide.com]EU-IT-Systems@withersworldwide.com[/email]"_
, " "_
, " "_
, " "_
, "Please contact the European IT Systems Team with any issues"_
, " "_
, " "_
, " " ), vbCrLf ) 
objEmail.Configuration.Fields.Item _
("[link=http://schemas.microsoft.com/cdo/configuration/sendusing]http://schemas.microsoft.com/cdo/configuration/sendusing[/link]") = 2
objEmail.Configuration.Fields.Item _
("[link=http://schemas.microsoft.com/cdo/configuration/smtpserver]http://schemas.microsoft.com/cdo/configuration/smtpserver[/link]") = _
"IP ADDRESS HERE"
objEmail.Configuration.Fields.Item _
("[link=http://schemas.microsoft.com/cdo/configuration/smtpserverport]http://schemas.microsoft.com/cdo/configuration/smtpserverport[/link]") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
End If
If (CDate(objDomainAdms.whenChanged) > CDate(objAdmins.whenChanged)) Then
strLastChanged = objDomainAdms.whenChanged
Else
strLastChanged = objAdmins.whenChanged
End If

' Increment last creation date by one second.
strLastChanged = CStr(DateAdd("s", 1, CDate(strLastChanged)))

' Save last creation date.
Set objDateFile = objFSO.OpenTextFile(strLastDateFile, _
ForWriting, CreateIfNotExist, OpenAsASCII)
objDateFile.WriteLine strLastChanged

' Clean up.
objDateFile.Close

Post #: 1

RE: Monitor Domain Admins & Administrators Group - 2/18/2008 9:43:37 PM

interacss

Posts: 2
Score: 0
Joined: 2/13/2008
Status: offline

Hi, this could be the very script I'm looking for. However, would this be able to be modified to monitor an FTP server.

IE: 3rd party company uploads something to my ftp server as requested, the vbscript picks up on that, and will send an automatic email to 1 or more specific email addresses.

Any offers greatly appreciated.

(in reply to cjwallace)