Tag: auditing

Query all services, both system and per-user, get the binary responsible for the service, which will be a dll when the service executable is svchost,exe and check its digital signature.
By default, only services whose binary is not validly signed will be shown but parameters are available to show any signing state and to show all services or just non-Microsoft ones

This script will scan the Security log for evidence of recent changes to the local Administrators group and report whether the required audit policy is configured on the machine.

This script will check if the user is part of BUILTINAdministrators, directly named This script will check if the user is a member of BUILTINAdministrators, directly named
or inherited from other local or domain groups

Show the Citrix Director actions performed in a given time window, optionally filtered on a specific user. Use this SBA to see what actions have been taken which might affect end users such as logging them off.
Arguments:
Start - optional time to show actions from. Can be specified as a date/time or as a number of units of time back from the present such as 7d or 1w where s=second,m=minute,h=hour,d=day,w=week,y=year (default is 7 days)
End - time to stop showing actions after. Can be specified either as a date/time or a number of units of time from the start value specified. (default is the current time)
If date/time values are used, they must be enclosed in double quotes, e.g. "02/02/2018 08:00:00"
Username - optional name of a user to just show changes for

Show the configuration changes made in Citrix Studio in a given time window, optionally filtered on a specific user. Use this SBA to see if any changes have been made which might be affecting end users.
Arguments:
Start - optional time to show changes from. Can be specified as a date/time or as a number of units of time back from the present such as 7d or 1w where s=second,m=minute,h=hour,d=day,w=week,y=year (default is 7 days)
End - time to stop showing changes after. Can be specified either as a date/time or a number of units of time from the start value specified. (default is the current time)
If date/time values are used, they must be enclosed in double quotes, e.g. "02/02/2018 08:00:00"
Username - optional name of a user to just show changes for

Retrieve Citrix Provisioning Services audit events, if auditing has been enabled although it can be enabled by this SBA if required. Use to see what administrative actions were performed in an optional time window, by whom and what was done. It must be run with the credentials of a user who has been granted PVS access.
Arguments:
Enable Auditing - if auditing is not enabled, specifying true for this parameter will enable auditing if the user running the SBA has sufficient privilege.
Start - optional time to show audit events from. Can be specified as a date/time or as a number of units of time back from the present such as 7d or 1w where s=second,m=minute,h=hour,d=day,w=week,y=year
End - optional time to stop showing audit events after. Can be specified either as a date/time or a number of units of time from the start value specified.
If date/time values are used, they must be enclosed in double quotes, e.g. "02/02/2018 08:00:00"

Audit ControlUp Actions against a computer object