Generates alert when a local or domain administrator account gets created on a server

Download JSON Download Python

Ratings

Release Time

04/04/2018

Downloads

907 times

Update Time

11/18/2024

Views

758 times

Share-it:

Tags

Domain Script monitroing

The following script is for monitoring condition that alerts when a local or domain administrator account gets created on a server.

Note:

Run the script as monitoring script.
First time when the script runs it will generate a text file to save the "domain users" u already have in the name of default users.
In the first time a new file will get generated with a low kb value around 1 to 10 kb which contains the user values to compare.
Next time when you run the script another file get created and the contents of the files get compared and the new user added is displayed.
Whenever a new user is added an alert will get generated.

Procedure's Instructions

import os;
import ctypes
import os.path
import sys
import shutil
def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))

data0=[]
if not os.path.isfile('C:/ProgramData/me.txt'):
    a = os.popen('wmic useraccount get name').read()
    datas = []
    for i in [i.strip() for i in a.split('\n')  if i.strip()]:
        if i not in ('Name', 'DefaultAccount', 'Administrator'):
            datas.append(i)
    with open('C:/ProgramData/me.txt','w') as data:
        data.write(",".join(datas))
    if os.path.isfile('C:/ProgramData/me.txt'):
        data0 = [line.strip() for line in open("C:/ProgramData/me.txt", 'r')]
        data0 = ','.join(data0)
        data0 = data0.split(',')
        print "The existing users are: "
        for item in data0:
            print item
        alert(0)
    else:
        print "List is Empty"

else:
    b = os.popen('wmic useraccount get name').read()
    datas = []
    for i in [i.strip() for i in b.split('\n')  if i.strip()]:
        if i not in ('Name', 'DefaultAccount', 'Administrator'):
            datas.append(i)
    with open('C:/ProgramData/we.txt','w') as data:
        data.write(",".join(datas))
    data1 = [line.strip() for line in open("C:/ProgramData/we.txt", 'r')]
    data1 = ','.join(data1)
    data1 = data1.split(',')
    data0 = [line.strip() for line in open("C:/ProgramData/me.txt", 'r')]
    data0 = ','.join(data0)
    data0 = data0.split(',')
    if (list(set(data1).difference (set(data0)))):
        result = list(set(data1).difference (set(data0)))
        print "The new user is/are"
        for item in result:
            print item 
        alert(1)   
    else:
        print "no user added"
        alert(0)
    shutil.copy("C:/ProgramData/we.txt", "C:/ProgramData/me.txt")

Comments

No Comments.

Generates alert when a local or domain administrator account gets created on a server

Comments

Leave a Comment