?
Solved

Account lockout report

Posted on 2014-02-10
5
Medium Priority
?
940 Views
Last Modified: 2014-03-28
Is there a good script I can run so the Helpdesk can review reports daily if there are account lockouts.  It would be nice to set this up so they don't have to bother higher support if there is a rogue machine locking the account out.  More specifically 4740 events.  A pdf format would be great as an output and placed on a share.
0
Comment
Question by:mystikal1000
5 Comments
 

Expert Comment

by:nacAdmin
ID: 39848121
Hello,

Have you looked at the powershell plugins from Quest (Dell)? We use them here to proactively alert users of when their AD password is going to expire, etc. Take a look at them here: http://www.quest.com/powershell/activeroles-server.aspx

I am sure you can use them to create a report as you describe;

HTH,

David
0
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 2000 total points
ID: 39848344
You can easily accomplish this using the built-in commands with powershell. Use the following syntax below...
The command below gets all AD users that are disabled in your environment and exports to a CSV file
get-aduser -Filter * -Properties * | ? {$_.Enabled -eq $False} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers.csv

Open in new window


If you want to narrow the search down to each day you can use the below syntax...
$date = get-date
Get-ADUser -Filter * -Properties * | ? {$_.Enabled -eq $false -and $_.whenChanged -eq $date.adddays(-1)} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers1day.csv 

Open in new window


Unfortunately you cannot export to a PDF file so for both examples i have exported to a CSV.

Will.
0
 
LVL 39

Expert Comment

by:Mahesh
ID: 39848596
You can use below PowerShell script to find out locked out accounts if you have 2008 R2 Domain controller
http://gallery.technet.microsoft.com/scriptcenter/Get-list-of-Active-04059d53

Alternatively you can use 3rd party tools such as Manage Engines
http://www.manageengine.com/products/ad-manager/windows-active-directory-account-lockout-disabled-users-reports.html

Mahesh
0
 
LVL 2

Expert Comment

by:allen_rich
ID: 39849254
To Try the Powershell script for Account Lockout:

$Event=get-eventlog -log security | where {$_.eventID -eq 4740} | Sort-Object index -Descending | select -first 1
$MailBody= $Event.message

$MailSubject= "User Account locked out"
$SmtpClient = New-Object system.net.mail.smtpClient
$SmtpClient.host = "smtp.domain.com"
$MailMessage = New-Object system.net.mail.mailmessage
$MailMessage.from = "AcctLockNotify@domain.com"
$MailMessage.To.add("helpdesk@domain.com")
$MailMessage.IsBodyHtml = 1
$MailMessage.Subject = $MailSubject
$MailMessage.Body = $MailBody
$SmtpClient.Send($MailMessage)
0
 
LVL 1

Author Comment

by:mystikal1000
ID: 39853183
Allen_Rich - Instead of email, is there a way to export this data in a file each day?  I rather not use a 3rd party tool?  Do I have to run this script on all DC's?
0

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
I’m willing to make a bet that your organization stores sensitive data in your Windows File Servers; files and folders that you really don’t want making it into the wrong hands.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question