Solved

Account lockout report

Posted on 2014-02-10
5
850 Views
Last Modified: 2014-03-28
Is there a good script I can run so the Helpdesk can review reports daily if there are account lockouts.  It would be nice to set this up so they don't have to bother higher support if there is a rogue machine locking the account out.  More specifically 4740 events.  A pdf format would be great as an output and placed on a share.
0
Comment
Question by:mystikal1000
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 

Expert Comment

by:nacAdmin
ID: 39848121
Hello,

Have you looked at the powershell plugins from Quest (Dell)? We use them here to proactively alert users of when their AD password is going to expire, etc. Take a look at them here: http://www.quest.com/powershell/activeroles-server.aspx

I am sure you can use them to create a report as you describe;

HTH,

David
0
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 500 total points
ID: 39848344
You can easily accomplish this using the built-in commands with powershell. Use the following syntax below...
The command below gets all AD users that are disabled in your environment and exports to a CSV file
get-aduser -Filter * -Properties * | ? {$_.Enabled -eq $False} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers.csv

Open in new window


If you want to narrow the search down to each day you can use the below syntax...
$date = get-date
Get-ADUser -Filter * -Properties * | ? {$_.Enabled -eq $false -and $_.whenChanged -eq $date.adddays(-1)} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers1day.csv 

Open in new window


Unfortunately you cannot export to a PDF file so for both examples i have exported to a CSV.

Will.
0
 
LVL 37

Expert Comment

by:Mahesh
ID: 39848596
You can use below PowerShell script to find out locked out accounts if you have 2008 R2 Domain controller
http://gallery.technet.microsoft.com/scriptcenter/Get-list-of-Active-04059d53

Alternatively you can use 3rd party tools such as Manage Engines
http://www.manageengine.com/products/ad-manager/windows-active-directory-account-lockout-disabled-users-reports.html

Mahesh
0
 
LVL 2

Expert Comment

by:allen_rich
ID: 39849254
To Try the Powershell script for Account Lockout:

$Event=get-eventlog -log security | where {$_.eventID -eq 4740} | Sort-Object index -Descending | select -first 1
$MailBody= $Event.message

$MailSubject= "User Account locked out"
$SmtpClient = New-Object system.net.mail.smtpClient
$SmtpClient.host = "smtp.domain.com"
$MailMessage = New-Object system.net.mail.mailmessage
$MailMessage.from = "AcctLockNotify@domain.com"
$MailMessage.To.add("helpdesk@domain.com")
$MailMessage.IsBodyHtml = 1
$MailMessage.Subject = $MailSubject
$MailMessage.Body = $MailBody
$SmtpClient.Send($MailMessage)
0
 
LVL 1

Author Comment

by:mystikal1000
ID: 39853183
Allen_Rich - Instead of email, is there a way to export this data in a file each day?  I rather not use a 3rd party tool?  Do I have to run this script on all DC's?
0

Featured Post

Backup Solution for AWS

Read about how CloudBerry Backup fully integrates your backups with Amazon S3 and Amazon Glacier to provide military-grade encryption and dramatically cut storage costs on any platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
A quick Powershell script I wrote to find old program installations and check versions of a specific file across the network.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question