Experts Exchange connects you with the people and services you need so you can get back to work.

automate notification for disable user account in AD

We run Windows Server 8 R2 with Exchange 2010. Is there a script to get notification as soon as the user go into disabled status in AD?

TreeRootHD

Asked: 2016-10-05

Advertise Here

2 Solutions

LVL 40

SubsunCommented: 2016-10-05

If you are talking about alert for any disabled user account, better enable active directory auditing and create a alert for Security log for event ID’s 4725 (User Account Management task category).

Set email alert for an event
https://blogs.technet.microsoft.com/jhoward/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger/

If you are trying to monitor a single user, then PowerShell script is better option..

LVL 59

McKnifeCommented: 2016-10-05

Setup a scheduled task on all of your DCs that uses event triggers. When account management is audited at the DCs, an event is logged to their security event logs. You can define an action that notifies you very simple using powershell mailing.

Steps:
1 create and right away disable a test account
2 open the DC's eventvwr and in it, the security log. Search for the username (1) so you'll find the event number and all.
3 create a task that gets triggered by this event and sends you the event (2) as body

If you need further help, just say

Edit: sorry subsun... just got distracted while writing and now yours was there, first.

LVL 40

SubsunCommented: 2016-10-05

No worries :-)

TreeRootHDAuthor Commented: 2016-10-06

That worked well. Thank you both.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

automate notification for disable user account in AD

Join & Write a Comment Already a member? Login.

Featured Post