Solved

automate notification for disable user account in AD

Posted on 2016-10-05
4
27 Views
Last Modified: 2016-10-06
We run Windows Server 8 R2 with Exchange 2010. Is there a script to get notification  as soon as the user go into disabled status in AD?
0
Comment
Question by:TreeRootHD
  • 2
4 Comments
 
LVL 40

Accepted Solution

by:
Subsun earned 250 total points
Comment Utility
If you are talking about alert for any disabled user account, better enable active directory auditing and create a alert for  Security log for event ID’s 4725 (User Account Management task category).

Set email alert   for an event  
https://blogs.technet.microsoft.com/jhoward/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger/

If you are trying to monitor a single user, then PowerShell script is better option..
0
 
LVL 53

Assisted Solution

by:McKnife
McKnife earned 250 total points
Comment Utility
Setup a scheduled task on all of your DCs that uses event triggers. When account management is audited at the DCs, an event is logged to their security event logs. You can define an action that notifies you very simple using powershell mailing.

Steps:
1 create and right away disable a test account
2 open the DC's eventvwr and in it, the security log. Search for the username (1) so you'll find the event number and all.
3 create a task that gets triggered by this event and sends you the event (2) as body

If you need further help, just say

Edit: sorry subsun... just got distracted while writing and now yours was there, first.
0
 
LVL 40

Expert Comment

by:Subsun
Comment Utility
No worries :-)
0
 

Author Closing Comment

by:TreeRootHD
Comment Utility
That worked well. Thank you both.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

This article will help you understand what HashTables are and how to use them in PowerShell.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now