• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3273
  • Last Modified:

Source of AD lockout via Powershell Script

need to get a source (machine or ip) for AD account lockout via PS script.

given samaccountname via the input file.... want to run query against the domain controller and pull the lockout info for user including the source/machine name
1 Solution

LockoutStatus works great for this.  It works best if you can "catch it in the act"
ARM2009Author Commented:
already using this... i am looking more of a script to check on user account instead of going through logs.
Dale HarrisProfessional Services EngineerCommented:
When an account is locked out, it's not held on the AD Account where the source came from unfortunately.  Your best best is to use a powershell script to search for that specific event, and find the information where it specifies the machine it came from.  Let's do something similar for non-DC event logs on my computers, since I don't have access to a DC right now:

$Logs = Get-WinEvent -FilterHashTable @{LogName='Security'; id=4648; StartTime=((get-date).adddays(-1))} -ErrorAction SilentlyContinue
$Logs | %{$_.message >> "LogonLog.txt"}
Select-string -path "LogonLog.txt" "Account Name:"

Open in new window

And then you can choose to export that as well, a very well defined list that shows you exactly which accounts have logged in.  This would be easily adapted by changing the 4648 to your specific lockout numbers, and then when you read the message, look for the specific text that shows which computer did the lock out.  You can also choose to find the computer and username associated (which account was locked out by which computer) by using that same methodology, by using a -context 6 which will show also the next 6 lines.  If the Computer name is only 3 lines away from where the account is specified, just use a 3 instead of 6.


Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

You may try this PS script.. Script will prompt you to input the user name and DC name.

$ErrorActionPreference = SilentlyContinue
$UserName = Read-Host "Please enter user name"
$DC = Read-Host "Please enter DC name"
$Event = get-eventlog -computer $DC -log security -InstanceID “4740" | ? {$_.Message -match $UserName} | Sort-Object index -Descending | select -first 1
If ($Event -ne $null){
$User = $Event.ReplacementStrings[0]
$Computer = $Event.ReplacementStrings[1]
$Domain = $Event.ReplacementStrings[5]
$Time = $Event.TimeGenerated
Write-Host "$Domain\$user Locked from computer $Computer at $Time" -BackgroundColor Yellow -ForegroundColor Red
Else {Write-Host "No Events found for "$UserName" in $DC" -BackgroundColor Yellow -ForegroundColor Red}

Open in new window

PS : In Windows Server 2003 DC the event ID for account lockout is 539 and In Windows Server 2008 R2, it is 4740.
ARM2009Author Commented:
would this script work using quest powershell?
Yes it will work. The Script doesn't use Quest CMDLETs , so you can also run in from normal PowerShell console.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now