A Better Way to Start and Stop Netwrix Auditor Services
In search of a solution that allows me to start and stop the various services the Netwrix Auditor Server uses, I came up with this script.
Scripts
Full on scripts that achieve a particular function or set of functions to assist in making system administrator’s lives easier.
Query Your Windows Environment for Current Sessions
This script will query all your systems (or subset of them) for what sessions are currently open, along with their status. This can help you enforce login policies.
Audit Admin Logins Over Last 7 Days via PowerShell
This script allows you to find out which admin accounts were used in the last 7 days. This allows you to identify any potential misuse or abuse.
Check for Recent Bad Password Attempts on Accounts
This script will help you find out what accounts in your environment logged bad login attempts in the last day so you can further investigate.
Identify Recently Modified Active Directory Groups via PowerShell
This script will help you identify which groups have recently been updated in your Active Directory environment so you can investigate.
Show Accounts Whose Passwords Changed in Last 7 Days
Need to know whose accounts recently changed their password in the last 7 days or otherwise? This script will help you find out.
Search for Modified User Accounts via PowerShell
As part of a healthy security strategy, its a good idea to keep tabs on account modifications in your environment. This script helps you accomplish that.
Audit New Users Created in Active Directory Through PowerShell
This script allows you to find out what users were created in your Active Directory environment in the last 24 hours. You can further customize to your environment.
Auditing Lithnet IdleLogoff Use and Current Logons
This script will help you audit your deployment of Lithnet's IdleLogoff tool and what users are currently logged in.
Clear Windows Server Event Log Archives with PowerShell
This script will allow you to clear the event archives that build in a windows server if you have archiving enabled in your event logs.