Improve company productivity with a Business Account.Sign Up

x
?
Solved

Account lockout report

Posted on 2014-02-10
5
Medium Priority
?
965 Views
Last Modified: 2014-03-28
Is there a good script I can run so the Helpdesk can review reports daily if there are account lockouts.  It would be nice to set this up so they don't have to bother higher support if there is a rogue machine locking the account out.  More specifically 4740 events.  A pdf format would be great as an output and placed on a share.
0
Comment
Question by:mystikal1000
5 Comments
 

Expert Comment

by:nacAdmin
ID: 39848121
Hello,

Have you looked at the powershell plugins from Quest (Dell)? We use them here to proactively alert users of when their AD password is going to expire, etc. Take a look at them here: http://www.quest.com/powershell/activeroles-server.aspx

I am sure you can use them to create a report as you describe;

HTH,

David
0
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 2000 total points
ID: 39848344
You can easily accomplish this using the built-in commands with powershell. Use the following syntax below...
The command below gets all AD users that are disabled in your environment and exports to a CSV file
get-aduser -Filter * -Properties * | ? {$_.Enabled -eq $False} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers.csv

Open in new window


If you want to narrow the search down to each day you can use the below syntax...
$date = get-date
Get-ADUser -Filter * -Properties * | ? {$_.Enabled -eq $false -and $_.whenChanged -eq $date.adddays(-1)} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers1day.csv 

Open in new window


Unfortunately you cannot export to a PDF file so for both examples i have exported to a CSV.

Will.
0
 
LVL 41

Expert Comment

by:Mahesh
ID: 39848596
You can use below PowerShell script to find out locked out accounts if you have 2008 R2 Domain controller
http://gallery.technet.microsoft.com/scriptcenter/Get-list-of-Active-04059d53

Alternatively you can use 3rd party tools such as Manage Engines
http://www.manageengine.com/products/ad-manager/windows-active-directory-account-lockout-disabled-users-reports.html

Mahesh
0
 
LVL 2

Expert Comment

by:allen_rich
ID: 39849254
To Try the Powershell script for Account Lockout:

$Event=get-eventlog -log security | where {$_.eventID -eq 4740} | Sort-Object index -Descending | select -first 1
$MailBody= $Event.message

$MailSubject= "User Account locked out"
$SmtpClient = New-Object system.net.mail.smtpClient
$SmtpClient.host = "smtp.domain.com"
$MailMessage = New-Object system.net.mail.mailmessage
$MailMessage.from = "AcctLockNotify@domain.com"
$MailMessage.To.add("helpdesk@domain.com")
$MailMessage.IsBodyHtml = 1
$MailMessage.Subject = $MailSubject
$MailMessage.Body = $MailBody
$SmtpClient.Send($MailMessage)
0
 
LVL 1

Author Comment

by:mystikal1000
ID: 39853183
Allen_Rich - Instead of email, is there a way to export this data in a file each day?  I rather not use a 3rd party tool?  Do I have to run this script on all DC's?
0

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

You have missed a phone call. The number looks like it belongs to the bunch of numbers which your company uses. How to find out who has just called you?
Seizing the Operation Master Roles in Windows Server 2016 in case of FSMO holder failure.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…

606 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question