How to monitor claims in Active Directory Federated Services

Active Directory Federated Services (AD FS) allows two organizations to work in a partnership while less administrative overhead.  A resource organization can choose to allow an external organizations users selective access to their internal resources without managing additional user objects. The account organization an have their users access someone else's resources utilizing their normal Active Directory accounts.

 

AD FS does not have a mechanism that allows the resource organization to monitor who has accessed their resources.  The below setup and PowerShell script will allow for this data to be collected and presented to the resource organization so they know who made an AD FS claim and when.

 

Logging Setup:

Open Active Directory Federated Services console from the Administrator Tools.

Right click Federation Service and select Properties.

Click the Troubleshooting tab.

Check Informational and make note of the location where the logs will be stored.

 

Below is a PowerShell function that you can add to your code or Dot Source it in and use it on its own.

 

<#
.SYNOPSIS
Extract the users and time stamp information from
ADFS Logs.
.DESCRIPTION
Extracts the user name (including UPN suffix) and the
date/time stamp from the Active Directory Federated
Services troubleshooting log.  The trouble shooting logs
must be set to record at least "Informational" events
for this to work.

.PARAMETER ExcelFile
The name of the file being tested
.EXAMPLE
get-ADFSClaimes 

User                                                        TimeStamp
----                                                        ---------
{Spencer@Contoso.com}                                       {2011-07-16T00:17:10}
{Adam@Contoso.com}                                          {2011-07-16T00:22:42}
{Adam@Contoso.com}                                          {2011-07-16T00:24:37}
{Arthur@Contoso.com}                                        {2011-07-16T00:30:26}
{Adam@Contoso.com}                                          {2011-07-16T00:32:19}
{Don@Contoso.com}                                           {2011-07-17T16:18:05}
{Adam@Contoso.com}                                          {2011-07-17T16:28:43}

Extracts all the logs in the default ADFS log file folder and displays the
User and date/time stamps for each claim.
#>

Function Get-ADFSClaims
{


# Set the location where to find the AD FS
# Troubleshooting logs.
$ADFSLogs = "N:\Data\*.log"


# Load the list of logs.
$ADFSLogList = Get-Item -Path $ADFSLogs

# Create and object to hold the results.
$LogObject = @()

# Parse through each log file and extract the list
# of users who made claims.
ForEach ($Log in $ADFSLogList)
{
    $Contents = Get-Content $Log 
    For ($x=0 ; $x -le $Contents.count; $x++)

    
    {
        $Result = $Contents[$x] -Match "\w*\@\w*.com"
        If ($Result -eq $True) 
        {
            $LObj = New-Object PSObject
            $LObj | Add-Member NoteProperty -Name User -Value $Matches.values
            $Result = $Contents[$x-3] -match "\w*\-\w*\-\w*\:\w*\:\w*"
            If ($Result -eq $True)
            {
                $LObj | Add-Member NoteProperty -Name TimeStamp -Value $Matches.values
            }
            $LogObject += $LObj  
        }
    }
}
Write-Output $LogObject
}