Skip to main content

How to monitor claims in Active Directory Federated Services

Active Directory Federated Services (AD FS) allows two organizations to work in a partnership while less administrative overhead.  A resource organization can choose to allow an external organizations users selective access to their internal resources without managing additional user objects. The account organization an have their users access someone else's resources utilizing their normal Active Directory accounts.

 

AD FS does not have a mechanism that allows the resource organization to monitor who has accessed their resources.  The below setup and PowerShell script will allow for this data to be collected and presented to the resource organization so they know who made an AD FS claim and when.

 

Logging Setup:

Open Active Directory Federated Services console from the Administrator Tools.

Right click Federation Service and select Properties.

Click the Troubleshooting tab.

Check Informational and make note of the location where the logs will be stored.

image

 

Below is a PowerShell function that you can add to your code or Dot Source it in and use it on its own.

 

<#
.
SYNOPSIS
Extract the users and time stamp information from
ADFS Logs.
.
DESCRIPTION
Extracts the user name (including UPN suffix) and the
date/time stamp from the Active Directory Federated
Services troubleshooting log. The trouble shooting logs
must be set to record at least "Informational" events
for this to work.

.
PARAMETER ExcelFile
The name of the file being tested
.
EXAMPLE
get-ADFSClaimes

User TimeStamp
---- ---------
{
Spencer@Contoso.com} {2011-07-16T00:17:10}
{
Adam@Contoso.com} {2011-07-16T00:22:42}
{
Adam@Contoso.com} {2011-07-16T00:24:37}
{
Arthur@Contoso.com} {2011-07-16T00:30:26}
{
Adam@Contoso.com} {2011-07-16T00:32:19}
{
Don@Contoso.com} {2011-07-17T16:18:05}
{
Adam@Contoso.com} {2011-07-17T16:28:43}

Extracts all the logs in the default ADFS log file folder and displays the
User and date/time stamps for each claim.
#>


Function Get-ADFSClaims
{


# Set the location where to find the AD FS
# Troubleshooting logs.
$ADFSLogs = "N:\Data\*.log"


# Load the list of logs.
$ADFSLogList = Get-Item -Path $ADFSLogs

# Create and object to hold the results.
$LogObject = @()

# Parse through each log file and extract the list
# of users who made claims.
ForEach ($Log in $ADFSLogList)
{
$Contents = Get-Content $Log
For ($x=0 ; $x -le $Contents.count; $x++)


{
$Result = $Contents[$x] -Match "\w*\@\w*.com"
If ($Result -eq $True)
{
$LObj = New-Object PSObject
$LObj | Add-Member NoteProperty -Name User -Value $Matches.values
$Result = $Contents[$x-3] -match "\w*\-\w*\-\w*\:\w*\:\w*"
If ($Result -eq $True)
{
$LObj | Add-Member NoteProperty -Name TimeStamp -Value $Matches.values
}
$LogObject += $LObj
}
}
}
Write-Output $LogObject
}

Comments

Popular posts from this blog

Adding a Comment to a GPO with PowerShell

As I'm writing this article, I'm also writing a customization for a PowerShell course I'm teaching next week in Phoenix.  This customization deals with Group Policy and PowerShell.  For those of you who attend my classes may already know this, but I sit their and try to ask the questions to myself that others may ask as I present the material.  I finished up my customization a few hours ago and then I realized that I did not add in how to put a comment on a GPO.  This is a feature that many Group Policy Administrators may not be aware of. This past summer I attended a presentation at TechEd on Group Policy.  One organization in the crowd had over 5,000 Group Policies.  In an environment like that, the comment section can be priceless.  I always like to write in the comment section why I created the policy so I know its purpose next week after I've completed 50 other tasks and can't remember what I did 5 minutes ago. In the Group Policy module for PowerShell V3, th

Return duplicate values from a collection with PowerShell

If you have a collection of objects and you want to remove any duplicate items, it is fairly simple. # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   # Remove the duplicate values. $Set1 | Select-Object -Unique 1 2 3 4 5 6 7 What if you want only the duplicate values and nothing else? # Create a collection with duplicate values $Set1 = 1 , 1 , 2 , 2 , 3 , 4 , 5 , 6 , 7 , 1 , 2   #Create a second collection with duplicate values removed. $Set2 = $Set1 | Select-Object -Unique   # Return only the duplicate values. ( Compare-Object -ReferenceObject $Set2 -DifferenceObject $Set1 ) . InputObject | Select-Object – Unique 1 2 This works with objects as well as numbers.  The first command creates a collection with 2 duplicates of both 1 and 2.   The second command creates another collection with the duplicates filtered out.  The Compare-Object cmdlet will first find items that are diffe

How to list all the AD LDS instances on a server

AD LDS allows you to provide directory services to applications that are free of the confines of Active Directory.  To list all the AD LDS instances on a server, follow this procedure: Log into the server in question Open a command prompt. Type dsdbutil and press Enter Type List Instances and press Enter . You will receive a list of the instance name, both the LDAP and SSL port numbers, the location of the database, and its status.