Suspected Security breach: Viewing Event Viewer Security Logs

[talksr]

Good evening there. I have reason to believe that we may have had a security breach on our 2008 server.

I have noticed that in the past fortnight, a new administrator account has appeared in AD with a admin sounding username to blend in with what we already have.

 

I have tried to view (via power shell) when this account was created, or any others in the past 30 days, but the command is not going through.

 

Can anyone recommend to me some commands I may find useful in getting to the bottom of this?

If I open Event Viewer and go to Security, I can view all of the security info, but when I filter the logs selecting Event Logs: as "Microsoft Windows security auditing." If I try and type in the user in the user section (as in the below screenshot), it is unable to find anything, although I can manually scan through and see it in the logs.

 

 

This is my PowerShell version:

PS C:\Users\lmi123> $psversiontable.psversion

 

Major Minor Build Revision

----- ----- ----- --------

2 0 -1 -1

 

I am running Windows Server 2008 R2 Standard version 6.1 (Build 7601:SP1)

 

Any suggestions would be very much appreciated.

[ITGuyWestMidlands]

Check the attributes on the ad object in ad useres and computers

[ITGuyWestMidlands]

It will say when the object was created in there

[talksr]

Check the attributes on the ad object in ad useres and computers

 

Thanks for your post. Can you explain how I can do that?

[Matt_Renato]

Open AD Users and Computers

Click the view menu and check that there is a tick next to Advanced features

Browse to the user, right click and select properties

Select the Attribute Editor tab

You're looking for the whenCreated attribute

If it isn't showing click filter and check that show only writable attributes is not ticked and that optional is

[talksr]

Open AD Users and Computers

Click the view menu and check that there is a tick next to Advanced features

Browse to the user, right click and select properties

Select the Attribute Editor tab

You're looking for the whenCreated attribute

If it isn't showing click filter and check that show only writable attributes is not ticked and that optional is

 

Thanks very helpful. Advanced features were not enabled, that is why I couldn't find it!

 

It seems the account has been in place for years, but I never spotted it.

 

Is there any way I can drill down into the event viewer and obtain a clear to read log of which accounts have been logged into within a specific recent time frame and to which hosts?