Results 1 to 11 of 11
  1. #1
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    276
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Thumbs up

    Hello everyone. I'm guessing there might be a way to do what I'm looking for using Power Shell. We're running Windows Server 2003 and Exchange 2007 (one domain). We have a mail-enabled universal security group called Managers. A few days ago someone noticed that about 6 intern's accounts had found their way into that group. Is there some sort of Power Shell command I could run to find out when those accounts made their way into that security group?

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts
    Quote Originally Posted by telecomguy9 View Post
    Hello everyone. I'm guessing there might be a way to do what I'm looking for using Power Shell. We're running Windows Server 2003 and Exchange 2007 (one domain). We have a mail-enabled universal security group called Managers. A few days ago someone noticed that about 6 intern's accounts had found their way into that group. Is there some sort of Power Shell command I could run to find out when those accounts made their way into that security group?
    I'm not sure if you can get the date & time when each member was added but you can see the last time the group was modified in the Exchange Management Shell with the following:

    get-group -identity GROUPNAME | FL

    Joe
    Joe

  3. #3
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    276
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by joeperez View Post
    I'm not sure if you can get the date & time when each member was added but you can see the last time the group was modified in the Exchange Management Shell with the following:

    get-group -identity GROUPNAME | FL

    Joe
    Thanks for the command. I'll check it out.

  4. #4
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    276
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Quote Originally Posted by joeperez View Post
    I'm not sure if you can get the date & time when each member was added but you can see the last time the group was modified in the Exchange Management Shell with the following:

    get-group -identity GROUPNAME | FL

    Joe
    Well that didn't help. It was just changed 3 days ago and what I'm looking for occured a few weeks ago. Hmmm...

  5. #5
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts
    Quote Originally Posted by telecomguy9 View Post
    Well that didn't help. It was just changed 3 days ago and what I'm looking for occured a few weeks ago. Hmmm...
    You can use the Domain Manager (Active Directory User and Computers) MMC plugin and look at the Object tab on each user.

    Joe
    Joe

  6. #6
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    276
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thanks for the ideas. I did that and I don't see anything helpful. What was it you were thinking I should be able to see on that tab that might help me out?

  7. #7
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts
    Quote Originally Posted by telecomguy9 View Post
    Thanks for the ideas. I did that and I don't see anything helpful. What was it you were thinking I should be able to see on that tab that might help me out?
    Date Modified.

    Joe
    Joe

  8. #8
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    276
    Thanks
    0
    Thanked 0 Times in 0 Posts
    So maybe look at the date modified of the universal security group? It looks like that tells me exactly what running this told me: get-group -identity GROUPNAME | FL

    I think I may be out of luck, eh?

  9. #9
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts
    Quote Originally Posted by telecomguy9 View Post
    So maybe look at the date modified of the universal security group? It looks like that tells me exactly what running this told me: get-group -identity GROUPNAME | FL

    I think I may be out of luck, eh?
    You could try and add someone yourself. Then go to the Event Logs for the server and check the Security Log and see yor change was logged. If it was you could search the Log file for the same Event Ids.

    Joe
    Joe

  10. #10
    3 Star Lounger
    Join Date
    Dec 2001
    Location
    Atlanta, Georgia, USA
    Posts
    276
    Thanks
    0
    Thanked 0 Times in 0 Posts
    I'm assuming that when you say event logs and security log you're referring to event viewer and the security log in there, correct? If so I noticed that it had some pretty sparse records in it. A few for this year, a few for last year, etc. all the way back to 2004 where it has a lot more, but still not a ton. Am I looking in the right place? I'm looking on the domain controller.

  11. #11
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,585
    Thanks
    5
    Thanked 1,059 Times in 928 Posts
    Quote Originally Posted by telecomguy9 View Post
    I'm assuming that when you say event logs and security log you're referring to event viewer and the security log in there, correct? If so I noticed that it had some pretty sparse records in it. A few for this year, a few for last year, etc. all the way back to 2004 where it has a lot more, but still not a ton. Am I looking in the right place? I'm looking on the domain controller.
    Yes, the Event Viewer and the security log it what I meant.

    You can always check the System log too.

    Joe
    Joe

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •