Active Directory - Computer Object - Operating System Name changes

IdentityDirectoryEvents | where ActionType == @"Device Operating System changed" | extend FROMDeviceOperatingSystem = parse_json(AdditionalFields)["FROM Device Operating System"] | extend TODeviceOperatingSystem = parse_json(AdditionalFields)["TO Device Operating System"] | project TimeGenerated, TargetDeviceName, FROMDeviceOperatingSystem, TODeviceOperatingSystem | summarize arg_max(TimeGenerated, *) by TargetDeviceName

Explanation

This KQL (Kusto Query Language) query is designed to track changes in the operating system names of computer objects within Active Directory. Here's a simple breakdown of what the query does:

Data Source: It starts by looking at events in the IdentityDirectoryEvents table.
Filter: It filters the events to only include those where the action type is "Device Operating System changed". This means it focuses on events where a computer's operating system name has been updated.
Extract Information:
- It extracts the previous operating system name (FROMDeviceOperatingSystem) and the new operating system name (TODeviceOperatingSystem) from the AdditionalFields column, which contains JSON data.
Select Columns: The query selects the following columns to display:
- TimeGenerated: The time when the event was recorded.
- TargetDeviceName: The name of the device whose operating system name changed.
- FROMDeviceOperatingSystem: The original operating system name.
- TODeviceOperatingSystem: The updated operating system name.
Summarize: It uses the summarize function to get the most recent change for each device by using arg_max(TimeGenerated, *). This ensures that for each device, only the latest operating system name change is shown.

In summary, this query helps identify and display the most recent operating system name changes for each computer object in Active Directory.

KQL Search