Parameters
DC - domain controller FQDN.
Formatlist - output in list instead of table.
ExcludelastLogonTimestamp - exclude lastLogonTimestamp events from output
DumpAllObjects - dump all active directory before start. In case of changes It will show you all previous values. But in large domains use it on your own risk (time and resource consuming).
Short - in output will be only AttributeName, AttributeValue, LastOriginChangeTime and Explanation.
Output - create XML file with all output.
ExcludeObjectGUID - exclude Active Directory object with specific GUID.
Sleep - time interval between requests for USN number. By default - 30 seconds.
USN - specify started USN.
DisplayXML - display previous captured XML file.

How to use
Domain computer
Just run module in powershell session from domain user. For better performance use domain controller FQDN instead of IP address.

Non-domain computer
Start powershell session with domain user with runas. Check that domain controller accessible. For better performance use domain controller FQDN instead of IP address.

Performs automatic checks and identifies vulnerabilities
Enables login via Windows Integrated Authentication as well as SQL Authentication
Quickly activates XP_cmdshell if the permission exists (locally as well as on Linked Servers)
Convenient execution of system commands via XP_cmdshell (locally as well as on single/double Linked Servers)
Convenient execution of SQL commands (locally as well as on Linked Servers)
Fast triggering of NTLM requests via XP_dirtree
Custom Stored Procedure - for executing OS commands (locally)
Automatically checks and enables RPC OUT (if RPC OUT is disabled for Linked Servers, stored procedures such as xp_cmdshell on Linked Servers are not usable)
Automatic dumping of MSSQL user hashes

Loaded modules list
Drivers in memory code (compared to on-disk version)
Callbacks of kernel objects and internal ntoskrnl lists
PlugAndPlay tree and filters
Kernel types callbacks
FltMgr callbacks
KTimers DPC functions
IRP driver's tables
Driver signing global variables with callbacks
NDIS filters and callbacks
NetIO/FwpkCLNT filtering dispatch
Devices and their attached device objects
IDT entries
PatchGuard initialization and state