automate notification for disable user account in AD

TreeRootHD
TreeRootHD used Ask the Experts™
on
We run Windows Server 8 R2 with Exchange 2010. Is there a script to get notification  as soon as the user go into disabled status in AD?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solutions Only
IT Infrastructure Architect
Commented:
If you are talking about alert for any disabled user account, better enable active directory auditing and create a alert for  Security log for event ID’s 4725 (User Account Management task category).

Set email alert   for an event  
https://blogs.technet.microsoft.com/jhoward/2010/06/16/getting-event-log-contents-by-email-on-an-event-log-trigger/

If you are trying to monitor a single user, then PowerShell script is better option..
McKnife
Distinguished Expert 2018
Commented:
Setup a scheduled task on all of your DCs that uses event triggers. When account management is audited at the DCs, an event is logged to their security event logs. You can define an action that notifies you very simple using powershell mailing.

Steps:
1 create and right away disable a test account
2 open the DC's eventvwr and in it, the security log. Search for the username (1) so you'll find the event number and all.
3 create a task that gets triggered by this event and sends you the event (2) as body

If you need further help, just say

Edit: sorry subsun... just got distracted while writing and now yours was there, first.
Subash SundharanIT Infrastructure Architect

Commented:
No worries :-)
TreeRootHD

Author

Commented:
That worked well. Thank you both.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial