Sunday, 13 March 2016

Tracing the source of Active Directory user account lockouts

Every now and then a user will approach us and ask: “My account keeps getting locked constantly – why is it like that?”

I wrote a small PowerShell script that can help us to answer this question quickly. No need to open a monitoring tool and put a query, no need to browse Event Viewer, just login to any DC and run the attached script like this:

PS C:\Users dmin.daniel\Desktop> .\Get-CallerComputerName.ps1 -samaccountname wolf.d

The script will parse the Security Event Log of the PDC emulator domain controller and filter it for Events with ID 4740 and the samaccountname of the user getting locked and return you the source computer which causes the locking.

3 comments:

  1. Then there are emergency locksmiths who provide the same type of services as an auto locksmith, but can also assist with home and business needs. If you are locked out of your homes then these individuals have the tools necessary to help you gain access to your home. These locksmiths also offer the service of repairing broken locks. As an emergency locksmith, they can be called upon for fast service and immediate response whenever you need them.locksmith las vegas

    Lastly, there are residential and commercial locksmiths. These individuals are focused on installing residential and commercial locks. These locksmiths have the knowledge of the best available locks and can help you find the most suitable lock for your home or business needs. They also offer installation, repair, change and upgrade services to meet any of your residential or commercial lock needs. These are the locksmiths that most individuals call when they need assistance during regular business hours.

    ReplyDelete
  2. I adore your websites way of raising the awareness on your readers.
    locksmith company in Denver

    ReplyDelete
  3. Hello!
    What can you tell me about this locksmiths http://24-locksmith-baltimore.com/ device? Is it reliable enough to use it in my business?

    ReplyDelete