Check User history

[antoniogemelli]

Hello, There is a way to check with powershell script user history? Is possible to check who deactivate /modified or delete User ? Thanks

[LucD]

Which kind of users are you talking about?

Local on the vCenter or ESXi node, or in the SSO domain?

[antoniogemelli]

Local user

[LucD]

On the vCenter or ESXi node(s)?

[antoniogemelli]

vcenter

[LucD]

You would have to check the logs of the OS on which the vCenter is running.

But afaik there is no method to query that info via a vSphere API.

[LucD]

Or do you actually mean the Principals that are used in Permission assignments on the vCenter?

[antoniogemelli]

I would like to check if the account was in vcenter before give permission and why disappear (maybe expired?)

[LucD]

Like I mentioned earlier, there are afaik no public API to retrieve that information from the PSC.

One option, but which is rather circumstantial, is to forward the logs of the VCSA to LogInsight, and then use the LogInsight API to query the content of the logs.

William did a great post on the subject in Auditing/Logging vCenter Server authentication & authorization activities

See also Re: Get SSO Config inromation with PowerCLI  for further info on this.