#############################################################################################################################
# // Start of section Script initialization. Load all required modules and declare base variables \\

If (-not (Get-Module -Name 'ActiveDirectory' -ErrorAction SilentlyContinue)) {
    Import-Module ActiveDirectory
}

# Define variables
$Domain = '<FQDN of AD domain. Eg. contoso.com>'            ### Change according to your environment
$SMTPServer = '<FQDN or IP address of your SMTP server>'    ### Change according to your environment
$Time = (Get-Date).AddHours(-1)                             ### Change according to your requirement
$ListOfMonitoredGroups = $null
$ListOfMonitoredOUs = (
    "OU=OU1,$DomainDistinguishedName",
    "OU=OU2,$DomainDistinguishedName",
    "OU=OU3,$DomainDistinguishedName"
)                                                           ### Change according to your environment
$DomainDistinguishedName = (Get-ADDomain -Server $Domain).DistinguishedName
$ListOfDCs = Get-ADDomainController -Server $Domain -Filter { Name -like '*' } | Sort-Object

# https://www.morgantechspace.com/2013/08/active-directory-change-audit-events.html
# The following table document lists the event IDs of the Security Group Management category.
$EventIDHashTable = [ordered]@{
    '4727' = 'A security-enabled global group was created'
    '4728' = 'A member was added to a security-enabled global group'
    '4729' = 'A member was removed from a security-enabled global group'
    '4730' = 'A security-enabled global group was deleted'
    '4731' = 'A security-enabled local group was created'
    '4732' = 'A member was added to a security-enabled local group'
    '4733' = 'A member was removed from a security-enabled local group'
    '4734' = 'A security-enabled local group was deleted'
    '4735' = 'A security-enabled local group was changed'
    '4737' = 'A security-enabled global group was changed'
    '4754' = 'A security-enabled universal group was created'
    '4755' = 'A security-enabled universal group was changed'
    '4756' = 'A member was added to a security-enabled universal group'
    '4757' = 'A member was removed from a security-enabled universal group'
    '4758' = 'A security-enabled universal group was deleted'
    '4764' = 'A groups type was changed'
}


# \\ End of section Script initialization //
#############################################################################################################################
# // Start of main code section \\

## Part 1. First get the security logs from all domain controllers
$LogEntries = @()
$LogEntries = ForEach ($DC in $ListofDCs) {
    Write-Host "Processing domain controller $DC"
    Get-WinEvent -ComputerName $DC.Hostname -FilterHashtable @{
        Logname   = 'Security'
        StartTime = $Time
        ID        = 4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4754, 4755, 4756, 4757, 4758, 4764
    } -ErrorAction Ignore # In case you want to filter the results, pipe the results to a Where-Object clause like | Where-Object { $_.Message -notmatch "text" }
}
$LogEntries = $LogEntries | Sort-Object TimeCreated


## Part 2. Get a list of all groups located within the monitored OUs
$ListOfMonitoredGroups = ForEach ($MonitoredOU in $ListOfMonitoredOUs) {
    Get-ADGroup -Server $Domain -SearchBase $MonitoredOU -Filter '*'
}
$ListOfMonitoredGroups = $ListOfMonitoredGroups | Sort-Object -Property Name


## Part 3. Filter variable $LogEntries to match only the groups located within the monitored OUs
$FilteredLog = $null
$FilteredLog = ForEach ($LogEntry in $LogEntries) {
    $ListOfMonitoredGroups | ForEach-Object $_.Name {
        If ($LogEntry.Message -match $_.Name) {
            $LogEntry
        }
    }
}
$LogEntries = $FilteredLog | Sort-Object TimeCreated


##Part 4. Mail each entry in variable $LogEntries
If ($LogEntries -ne "") {
    ForEach ($LogEntry in $LogEntries) {
        #$Subject = "[$Domain] - Eventid " + $LogEntry.ID + " - " + $EventIDHashTable.Item($LogEntry.Id.ToString())

        # Mail report
        Write-Host "Emailing Report"
        $SmtpClient = New-Object Net.Mail.SmtpClient($smtpServer);
        $MailMessage = New-Object system.net.mail.mailmessage
        $MailMessage.From = '<from address>'
        $MailMessage.To.add('<mail recipient 1')
        $MailMessage.To.add('<mail recipient 2')
        $MailMessage.To.add('<mail recipient 3')
        $MailMessage.Subject = "[$Domain] - Eventid " + $LogEntry.ID + " - " + $EventIDHashTable.Item($LogEntry.Id.ToString())
        $MailMessage.IsBodyHtml = $false
        $MailMessage.Body = ($LogEntry | Format-List | Out-String)
        $smtpclient.Send($MailMessage)

        Start-Sleep 1
    }
}

# \\ End of main code section //
#############################################################################################################################