Notify Computers Joined to Domain

Question

I have been trying to use Adaxes and different tools to detect a new computer being joined to a domain or a computer being REjoined to the domain (uses an existing object). I have not had success with this in the way that I want.

Aside from detecting an event from all domain controllers and using other tools, is there any efficient way to go about doing this in Adaxes?

Such an event is really event ID 4742 in the security log of a domain controller but must be filtered to remove Anonymous Logon because of automatic domain secure channel events.

Answer 1

Hello,

If you are looking for a way to automatically trigger certain actions immediately once a computer is joined to a domain, this is not possible. Adaxes Business Rules can be triggered once an operation is performed via Adaxes. Business Rules cannot be triggered if something is made outside of Adaxes.

The only workaround here is to create a Scheduled Task that will scan your DCs on a certain periodic basis, say, once an hour, for recent 4742 events. Also, the Scheduled Task can parse the messages contained within the events and perform some actions based on the content of the event messages. For example, the Scheduled Task can run a PowerShell script that looks something like this:

Import-Module Adaxes

# Find domain controlers in domain example.com
$domainControlers = Get-AdmComputer -LdapFilter "(&(objectCategory=Computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" example.com

$date = (Get-Date).AddHours(-1) # Current time -1 hour

foreach ($domainControler in $domainControlers)
{
   $dnsHostName = $domainControler.DNSHostName
   Write-Host $dnsHostName
   if (-not([System.String]::IsNullOrEmpty($dnsHostName)))
   {
      $joinEvents = Get-EventLog -log security -computer $dnsHostName -After $date | where {$_.eventID -eq 4742}
      foreach ($joinEvent in $joinEvents)
      {
         $message = $joinEvent.Message
         # TODO: parse the message
      }
   }
}