Investigating account lockouts with Powershell

Reference - http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html

1. Find the domain controller that holds the PDC emulator role - (get-addomain).PDCEmulator
2. Using this information run the following Powershell query

## Define the username that’s locked out
$Username = ‘abertram’
 
## Find the domain controller PDCe role
$Pdce = (Get-AdDomain).PDCEmulator
 
## Build the parameters to pass to Get-WinEvent
$GweParams = @{
     ‘Computername’ = $Pdce
     ‘LogName’ = ‘Security’
     ‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]"
}
 
## Query the security event log
$Events = Get-WinEvent @GweParams