Änderungen im AD protokollieren

<#
    Parse and Export ActiveDirectory Audit-Logs to CSV (@colinardo administrator.de)
#>
$event_id_register = @{
    5136 = 'Object modified'  
    5137 = 'Object created'  
    5139 = 'Object moved'  
    5141 = 'Object deleted'  
}
$result = foreach($event in (Get-WinEvent -LogName Security -FilterXPath '*[System[Task = 14081]]' | sort TimeCreated)){  
    try{
        [xml]$xml = $event.toXML()
        $obj = '' | select TimeCreated,Type,User,ObjectDN,ObjectClass,Attribute,AttributeValue,OperationType,OldObjectDN,NewObjectDN  
    
        $obj.TimeCreated = $event.TimeCreated
        $obj.Type = $event_id_register[$event.id]
        $obj.User = ($xml.Event.EventData.Data | ?{$_.Name -eq 'SubjectDomainName'}).innerText + "\" + ($xml.Event.EventData.Data | ?{$_.Name -eq 'SubjectUserName'}).innerText  
        $obj.ObjectClass = ($xml.Event.EventData.Data | ?{$_.Name -eq 'ObjectClass'}).innerText  

        switch ($event.Id){
            5136 {
                $obj.Attribute = ($xml.Event.EventData.Data | ?{$_.Name -eq 'AttributeLDAPDisplayName'}).innerText  
                $obj.AttributeValue = ($xml.Event.EventData.Data | ?{$_.Name -eq 'AttributeValue'}).innerText  
                $obj.OperationType = @{
                    '%%14674' = 'Property added'  
                    '%%14675' = 'Property removed'  
                }[($xml.Event.EventData.Data | ?{$_.Name -eq 'OperationType'}).innerText]  
            }
            5139 {
                $obj.OldObjectDN = ($xml.Event.EventData.Data | ?{$_.Name -eq 'OldObjectDN'}).innerText  
                $obj.NewObjectDN = ($xml.Event.EventData.Data | ?{$_.Name -eq 'NewObjectDN'}).innerText  
            }
            {$_ -in 5136,5137,5141} {
                $obj.ObjectDN = ($xml.Event.EventData.Data | ?{$_.Name -eq 'ObjectDN'}).innerText  
            }
        }
        $obj
     }catch{}
}
$result | export-csv .\report.csv -Delimiter ";" -NoType -Encoding UTF8 -verbose