account lock script

import-module ActiveDirectory

Search-ADAccount –LockedOut

Select allOpen in new window

You can also select the attributes you want by running

import-module ActiveDirectory

Search-ADAccount –LockedOut | select Name, ect..

Select allOpen in new window

You can not get last bad password or bad password attempts because they do not exist.

This will hove you locked account at that time.... i am trying to look for accounts in past 1 hour. Some might be unlocked already... but need ro see who was locked and source.

This would be a complex script.  You would need to enable auditing on every domain controller and write a script to search the event logs.  Take a look at https://www.varonis.com/products/datadvantage/directory-services/

An alternate idea is to simply use a free lockout monitoring tool such as Manage Engine AD Audit Free or Netwrix Account Lockout Examiner
Saves a bit of time scripting. I use the latter (Netwrix)

You can see account name, lockout source, which DC reported lockout, how often was bad PW entered, how often has account locked out, is it currently locked out, and you can examine the reported machine to narrow down what caused the lockout.

Here is an example of how we get all the domain controllers in a domain, and then query the individual domain controllers for a user’s attributes:

$DomainControllers = Get-ADDomainController -Filter *

Foreach($DC in $DomainControllers)

 {

Get-ADUser -Identity brwilliams -Server $DC.Hostname `

-Properties AccountLockoutTime,LastBadPasswordAttempt,BadPwdCount,LockedOut

}

Select allOpen in new window

Get in detailed here: https://blogs.technet.microsoft.com/heyscriptingguy/2012/12/27/use-powershell-to-find-the-location-of-a-locked-out-user/

Script Display Active Directory User Account Lockout History:
https://gallery.technet.microsoft.com/scriptcenter/Get-User-Account-Lockout-2a2707f9

Here is another informative article for Active Directory locked account investigation process:
https://www.experts-exchange.com/articles/29305/Active-Directory-Locked-Account-Investigation-Process.html

In addition to above few more solutions out there you can check like; LepideAuditor, Change Auditor and IdentityManager to get in detailed about account lockout.

Hope this helps!

ajit,

the script pull data fine but i dont see the lockout source for the user. what attribute is that...

also... if account is already unlocked then will it pull data or only for locked user at that time.