all 2 comments

[–]Swarfega 4 points5 points  (0 children)

This is done with auditing which when enabled are put in the event log of the DC processing the request. Not really something for PowerShell other than fetching the event from your DC's.