Investigating account lockouts with Powershell - Revision history

George2 at 11:11, 27 April 2016

2016-04-27T11:11:14Z

2016-04-27T11:09:38Z

2016-04-27T10:24:36Z

2016-04-27T10:21:04Z

Created page with "http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html"

New page

http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html

@@ Line 21: / Line 21: @@
 </source>
-Here is Phils:
+Here is Phils:<br>
 <source lang="powershell">
 #Requires -Version 3.0

@@ Line 19: / Line 19: @@
 ## Query the security event log
 $Events = Get-WinEvent @GweParams
 </source>

← Older revision		Revision as of 10:24, 27 April 2016
Line 1:		Line 1:
−	http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html	+	Reference - http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html
		+
		+	# Find the domain controller that holds the PDC emulator role - (get-addomain).PDCEmulator
		+	# Using this information run the following Powershell query
		+	<source lang="powershell">
		+	## Define the username that’s locked out
		+	$Username = ‘abertram’
		+
		+	## Find the domain controller PDCe role
		+	$Pdce = (Get-AdDomain).PDCEmulator
		+
		+	## Build the parameters to pass to Get-WinEvent
		+	$GweParams = @{
		+	‘Computername’ = $Pdce
		+	‘LogName’ = ‘Security’
		+	‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]"
		+	}
		+
		+	## Query the security event log
		+	$Events = Get-WinEvent @GweParams
		+	</source>