Solved

Account lockout report

Posted on 2014-02-10
5
822 Views
Last Modified: 2014-03-28
Is there a good script I can run so the Helpdesk can review reports daily if there are account lockouts.  It would be nice to set this up so they don't have to bother higher support if there is a rogue machine locking the account out.  More specifically 4740 events.  A pdf format would be great as an output and placed on a share.
0
Comment
Question by:mystikal1000
5 Comments
 

Expert Comment

by:nacAdmin
ID: 39848121
Hello,

Have you looked at the powershell plugins from Quest (Dell)? We use them here to proactively alert users of when their AD password is going to expire, etc. Take a look at them here: http://www.quest.com/powershell/activeroles-server.aspx

I am sure you can use them to create a report as you describe;

HTH,

David
0
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 500 total points
ID: 39848344
You can easily accomplish this using the built-in commands with powershell. Use the following syntax below...
The command below gets all AD users that are disabled in your environment and exports to a CSV file
get-aduser -Filter * -Properties * | ? {$_.Enabled -eq $False} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers.csv

Open in new window


If you want to narrow the search down to each day you can use the below syntax...
$date = get-date
Get-ADUser -Filter * -Properties * | ? {$_.Enabled -eq $false -and $_.whenChanged -eq $date.adddays(-1)} | select displayname, samaccountname, enabled, whenChanged | Export-Csv -NoTypeInformation c:\DisabledUsers1day.csv 

Open in new window


Unfortunately you cannot export to a PDF file so for both examples i have exported to a CSV.

Will.
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 39848596
You can use below PowerShell script to find out locked out accounts if you have 2008 R2 Domain controller
http://gallery.technet.microsoft.com/scriptcenter/Get-list-of-Active-04059d53

Alternatively you can use 3rd party tools such as Manage Engines
http://www.manageengine.com/products/ad-manager/windows-active-directory-account-lockout-disabled-users-reports.html

Mahesh
0
 
LVL 2

Expert Comment

by:allen_rich
ID: 39849254
To Try the Powershell script for Account Lockout:

$Event=get-eventlog -log security | where {$_.eventID -eq 4740} | Sort-Object index -Descending | select -first 1
$MailBody= $Event.message

$MailSubject= "User Account locked out"
$SmtpClient = New-Object system.net.mail.smtpClient
$SmtpClient.host = "smtp.domain.com"
$MailMessage = New-Object system.net.mail.mailmessage
$MailMessage.from = "AcctLockNotify@domain.com"
$MailMessage.To.add("helpdesk@domain.com")
$MailMessage.IsBodyHtml = 1
$MailMessage.Subject = $MailSubject
$MailMessage.Body = $MailBody
$SmtpClient.Send($MailMessage)
0
 
LVL 1

Author Comment

by:mystikal1000
ID: 39853183
Allen_Rich - Instead of email, is there a way to export this data in a file each day?  I rather not use a 3rd party tool?  Do I have to run this script on all DC's?
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article will help you understand what HashTables are and how to use them in PowerShell.
Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question