Audit User Account Changes by automatically read Event Viewer

Introduction

Since there's a group of people responsible for maintaining the user accounts in Active Directory, I needed an application to log the changes made to those accounts. I developed a small C# class who interacts with Windows Event Viewer to look for changes made in Active Directory, including user accounts created, deleted and changed. The application is scheduled to run every 8 hours (Windows Scheduled Task) and saves a different file for each day

Using the Code

I declared the following attributes to manage the time, the date and a file to save exceptions

			
    private int hour = DateTime.Now.Hour;
    private string today = DateTime.Now.ToString("dd");
    private string yesterday = DateTime.Now.AddDays(-1).ToString("dd");
    private string month = DateTime.Now.ToString("MMM");
    private string year = DateTime.Now.ToString("yyyy");
    private StreamWriter errors = File.AppendText("c:/Audit/erros.txt");

I’ve written two methods. The first creates an Event Viewer object type, chooses the log “Security” and reads all entries in the last 8 hours seeking for three different types of events.

			
	public void ReadEvent()
    	{
        EventLog elog = new EventLog(); //Event Viewer object type
        elog.Log = "Security";
        StreamWriter sw;
                
        if (hour == 00)
            {
                //for the period 16H - 0H 
                sw = File.AppendText("c:/Audit/Report_" + yesterday + month + year + ".txt");
            }
        else
            {
                //for the periods 0H - 8H and 8H - 16H
                sw = File.AppendText("c:/Audit/Report_" + today + month + year + ".txt");
            }
 
        //total number of entries saved in Event Log
        int size = elog.Entries.Count;
       
        for (int i = 0; i < size; i++)
        {
            try
            {
                //check the entries in the last 8 hours
                if (elog.Entries[i].TimeWritten.Hour >= (DateTime.Now.AddHours(-8).Hour) && 
                        elog.Entries[i].TimeWritten.Hour <= (DateTime.Now.AddHours(-1).Hour))
                {
                    //624 is the event id for creating user accounts
                    if (elog.Entries[i].InstanceId == 624)
                    {
                        sw.WriteLine("User Account Created");
                        sw.WriteLine(elog.Entries[i].TimeWritten);
                        sw.WriteLine("Log: " + elog.Entries[i].Source + "\n" +
                                        "Message: " + elog.Entries[i].Message + "\n" +
                                            "=============================" + "\n\n");
                    }
 
                    //630 is the event id for deleting user accounts
                    if (elog.Entries[i].InstanceId == 630)
                    {
                        sw.WriteLine("User Account Deleted");
                        sw.WriteLine(elog.Entries[i].TimeWritten);
                        sw.WriteLine("Log: " + elog.Entries[i].Source + "\n" +
                                        "Message: " + elog.Entries[i].Message + "\n" +
                                            =============================+ "\n\n");
                    }
 
                    //642 is the event id for changing user accounts
                    if (elog.Entries[i].InstanceId == 642)
                    {
                        sw.WriteLine("User Account Changed");
                        sw.WriteLine(elog.Entries[i].TimeWritten);
                        sw.WriteLine("Log: " + elog.Entries[i].Source + "\n" +
                                        "Message: " + elog.Entries[i].Message + "\n" +
                                            =============================+ "\n\n");
                    }
                }
            }
            catch (Exception ex){
                errors.WriteLine("Date: " + DateTime.Now.Hour + "\n" + "Error: " + ex.Message + "\n");
            }
        }
        sw.Close();
    }

The second method is used to send the log file by e-mail. I’ll not transcript any code because it’s not the core of the article, just attach the log file and send it through the smtp server of the company

Points of Interest

I think this application is interesting in the way it helps you to interact with the Event Viewer and read its events in a more “user-friendly” way. This one in particular it’s useful to audit user account changes, making possible to log which account was changed, when and who changed it.

History

Version 0.1 – Saves the changes made to user accounts in a log file