---
updatedAt: 2025-08-14T13:53:48.000Z
agentTools:
  siteIndex: https://developer.n-able.com/llms.txt
  projectIndex: https://developer.n-able.com/n-sight/llms.txt
---

# AD Audit Script

```powershell PowerShell

$log_path = "c:\Temp\"
$computer = gc env:computername
$result = "result_" + (get-date (get-date).AddDays(-1) -uFormat "%Y-%m-%d") + "_" + $computer + ".log"
try
{
get-eventlog  -LogName Security -After (get-date).adddays(-1) -EntryType 'SuccessAudit'| ?{($_.eventid -eq "5141") -or (($_.eventid -eq "5136") -and ($_.message.Contains("groupPolicyContainer"))) -or ($_.eventid -eq "4720") -or ($_.eventid -eq "4738") -or ($_.eventid -eq "4728") -or ($_.eventid -eq "4729")} | select machinename,eventid,@{n='AccountName';e={$_.ReplacementStrings[1]}},message|Out-File -FilePath ($log_path + $result) -encoding ASCII -append -Width 1000
Write-Host "Success Message"
Exit 0
} catch 
{
Write-Host "Error Message"
Exit 1001
}
```

```json Response Example
{"success":true}
```

# SCRIPT