Difference between revisions of "Investigating account lockouts with Powershell"

From MyWiki
Jump to: navigation, search
(Created page with "http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html")
 
 
(2 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html
+
Reference - http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html
 +
 
 +
# Find the domain controller that holds the PDC emulator role - (get-addomain).PDCEmulator
 +
# Using this information run the following Powershell query
 +
<source lang="powershell">
 +
## Define the username that’s locked out
 +
$Username = ‘abertram’
 +
 
 +
## Find the domain controller PDCe role
 +
$Pdce = (Get-AdDomain).PDCEmulator
 +
 
 +
## Build the parameters to pass to Get-WinEvent
 +
$GweParams = @{
 +
    ‘Computername’ = $Pdce
 +
    ‘LogName’ = ‘Security’
 +
    ‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]"
 +
}
 +
 
 +
## Query the security event log
 +
$Events = Get-WinEvent @GweParams
 +
</source>
 +
 
 +
Here is Phils:<br>
 +
Reference - http://mikefrobbins.com/2013/11/29/powershell-script-to-determine-what-device-is-locking-out-an-active-directory-user-account/<br>
 +
 
 +
Syntax - .\ADLockOut.ps1 -UserName ‘username’
 +
<source lang="powershell">
 +
#Requires -Version 3.0
 +
<#
 +
.SYNOPSIS
 +
    Get-LockedOutUser.ps1 returns a list of users who were locked out in Active Directory.
 +
.DESCRIPTION
 +
    Get-LockedOutUser.ps1 is an advanced script that returns a list of users who were locked out in Active Directory
 +
by querying the event logs on the PDC emulator in the domain.
 +
.PARAMETER UserName
 +
    The userid of the specific user you are looking for lockouts for. The default is all locked out users.
 +
.PARAMETER StartTime
 +
    The datetime to start searching from. The default is all datetimes that exist in the event logs.
 +
.EXAMPLE
 +
    Get-LockedOutUser.ps1
 +
.EXAMPLE
 +
    Get-LockedOutUser.ps1 -UserName 'mikefrobbins'
 +
.EXAMPLE
 +
    Get-LockedOutUser.ps1 -StartTime (Get-Date).AddDays(-1)
 +
.EXAMPLE
 +
    Get-LockedOutUser.ps1 -UserName 'mikefrobbins' -StartTime (Get-Date).AddDays(-1)
 +
#>
 +
[CmdletBinding()]
 +
param (
 +
    [ValidateNotNullOrEmpty()]
 +
    [string]$DomainName = $env:USERDOMAIN,
 +
    [ValidateNotNullOrEmpty()]
 +
    [string]$UserName = "*",
 +
    [ValidateNotNullOrEmpty()]
 +
    [datetime]$StartTime = (Get-Date).AddDays(-3)
 +
)
 +
Invoke-Command -ComputerName (
 +
    [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain((
 +
        New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $DomainName))
 +
    ).PdcRoleOwner.name
 +
) {
 +
    Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740;StartTime=$Using:StartTime} |
 +
    Where-Object {$_.Properties[0].Value -like "$Using:UserName"} |
 +
    Select-Object -Property TimeCreated,
 +
        @{Label='UserName';Expression={$_.Properties[0].Value}},
 +
        @{Label='ClientName';Expression={$_.Properties[1].Value}}
 +
} -Credential (Get-Credential) |
 +
Select-Object -Property TimeCreated, UserName, ClientName
 +
</source>

Latest revision as of 11:11, 27 April 2016

Reference - http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html

  1. Find the domain controller that holds the PDC emulator role - (get-addomain).PDCEmulator
  2. Using this information run the following Powershell query 
## Define the username that’s locked out
$Username = ‘abertram’
 
## Find the domain controller PDCe role
$Pdce = (Get-AdDomain).PDCEmulator
 
## Build the parameters to pass to Get-WinEvent
$GweParams = @{
     ‘Computername’ = $Pdce
     ‘LogName’ = ‘Security’
     ‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]"
}
 
## Query the security event log
$Events = Get-WinEvent @GweParams

Here is Phils:
Reference - http://mikefrobbins.com/2013/11/29/powershell-script-to-determine-what-device-is-locking-out-an-active-directory-user-account/

Syntax - .\ADLockOut.ps1 -UserName ‘username’ 

#Requires -Version 3.0
<#
.SYNOPSIS
    Get-LockedOutUser.ps1 returns a list of users who were locked out in Active Directory.
.DESCRIPTION
    Get-LockedOutUser.ps1 is an advanced script that returns a list of users who were locked out in Active Directory
by querying the event logs on the PDC emulator in the domain.
.PARAMETER UserName
    The userid of the specific user you are looking for lockouts for. The default is all locked out users.
.PARAMETER StartTime
    The datetime to start searching from. The default is all datetimes that exist in the event logs.
.EXAMPLE
    Get-LockedOutUser.ps1
.EXAMPLE
    Get-LockedOutUser.ps1 -UserName 'mikefrobbins'
.EXAMPLE
    Get-LockedOutUser.ps1 -StartTime (Get-Date).AddDays(-1)
.EXAMPLE
    Get-LockedOutUser.ps1 -UserName 'mikefrobbins' -StartTime (Get-Date).AddDays(-1)
#>
[CmdletBinding()]
param (
    [ValidateNotNullOrEmpty()]
    [string]$DomainName = $env:USERDOMAIN,
    [ValidateNotNullOrEmpty()]
    [string]$UserName = "*",
    [ValidateNotNullOrEmpty()]
    [datetime]$StartTime = (Get-Date).AddDays(-3)
)
Invoke-Command -ComputerName (
    [System.DirectoryServices.ActiveDirectory.Domain]::GetDomain((
        New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $DomainName))
    ).PdcRoleOwner.name
) {
    Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740;StartTime=$Using:StartTime} |
    Where-Object {$_.Properties[0].Value -like "$Using:UserName"} |
    Select-Object -Property TimeCreated,
        @{Label='UserName';Expression={$_.Properties[0].Value}},
        @{Label='ClientName';Expression={$_.Properties[1].Value}}
} -Credential (Get-Credential) |
Select-Object -Property TimeCreated, UserName, ClientName
Retrieved from "https://wiki.twig.es/index.php?title=Investigating_account_lockouts_with_Powershell&oldid=3216"