Support
 
Phone Get Quote
 
Support
 
US: +1 888 720 9500
US: +1 888 791 1189
Intl: +1 925 924 9500
Aus: +1 800 631 268
UK: 0800 028 6590
CN: +86 400 660 8680

Direct Inward Dialing: +1 408 916 9892

Live Chat

How to find who created an AD account with PowerShell and ADAudit Plus

The following is a comparison between the procedures to identify a user who created an account with Windows PowerShell and ADAudit Plus:

Windows PowerShell

Steps to obtain a user account report in Windows PowerShell

  • Define the domain from where the report should be generated.
  • Define the UPN and sAMaccount name for the newly created account.
  • Define the domain controller to retrieve the report from.
  • Execute the script.

Find the user who created an account

Code:

$dcs = Get-ADDomainController -Filter {Name -like "*"}

$upn = 'sometext@gmail.com'

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4720} |
Where-Object { $_.Message -match "user principal name:\s+$upn" } |
Select-Object -Expand Message |
Select-String '(?<=subject:\s+security id:\s+\S+\s+account name:\s+)\S+' |
Select-Object -Expand Matches |
Select-Object -Expand Value
$exportFilePath = "c:\scripts\lastLogon.csv"
$columns = "username,datetime"
Out-File -filepath $exportFilePath -force -InputObject $columns
 Copied
Click to copy entire script

ADAudit Plus

Steps to obtain a user management report in ADAudit Plus

  • Login to ADAudit Plus web console using administrator credential. Select the 'Reports' tab and navigate to 'User Management' panel on the left.
  • Select the 'Recently Created User' report. In the advanced search filter, select 'SAM account' 'is' 'account_name'
  • Under the 'Caller Username' column, you can view who has created the account.
  • You can also choose to export this report in the desired format (CSV, HTML, XLS, PDF) using the export option.

Screenshot

how-to-tell-who-created-an-active-directory-account-powershell-1
 

Why ADAudit Plus is the better solution to get user activity reports

  • ADAudit Plus allows you to export reports in the desired format easily with a single click.
  • Automatically scans all DCs to obtain the required report.
  • Comes with advanced filter options that save you the trouble of creating complex LDAP queries.
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  • Get Your Free Trial
  • Avoid complex PowerShell-scripting, and simplify AD change auditing with ADAudit Plus.
  • -Select-
  • By clicking 'Get Your Free Trial', you agree to processing of personal data according to the Privacy Policy.
  •  
  • Thanks!
  • Your download is in progress and it will be completed in just a few seconds! If you face any issues, download manually here.

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

  • Active Directory
  • File servers
  • Windows server
  • Workstation
  • Compliance
  • Related Products

A single pane of glass for complete Active Directory Auditing and Reporting

Free Trial Get Quote
Email Download Link
Back to Top