new push

Binoculars.ps1

@@ -0,0 +1,51 @@
+## Created by Zak Bearman - Intel - Datacom - For use on any domain that WinRM is enabled and supported for remote log searching##
+cls
+# Define the username you are searching for
+$username = read-host "Please enter users account" # Replace with the username of the locked-out user
+# Get the PDC Emulator
+$pdcemulator = (Get-ADDomain).PDCEmulator
+$DomainControllers = Get-ADDomainController $pdcemulator | Select-Object -ExpandProperty HostName
+
+# Define log file path
+$logFile = "C:\Temp\AccountLockoutLog.txt"
+
+# Create the log file if it doesn't exist
+if (-not (Test-Path $logFile)) {
+    New-Item -Path $logFile -ItemType File -Force
+}
+
+# Loop indefinitely every 5 minutes
+while ($true) {
+    foreach ($DC in $DomainControllers) {
+        Write-Host "Searching on: $DC"
+        Add-Content -Path $logFile -Value "Searching on: $DC - $(Get-Date)"
+
+        # Use Invoke-Command to remotely query the domain controller
+        Invoke-Command -ComputerName $DC -ScriptBlock {
+            param ($username)
+
+            # Query the Security event log for Event ID 4625 (Failed Login Attempt)
+            $events4625 = Get-EventLog -LogName "Security" -InstanceId 4625 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
+            foreach ($event in $events4625) {
+                $timeGenerated = $event.TimeGenerated
+                $message = $event.Message
+
+                Write-Host "Failed login attempt: $message at $timeGenerated"
+                Add-Content -Path $using:logFile -Value "Failed login attempt: $message at $timeGenerated"
+            }
+
+            # Query the Security event log for Event ID 4740 (Account Lockout)
+            $events4740 = Get-EventLog -LogName "Security" -InstanceId 4740 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
+            foreach ($event in $events4740) {
+                $timeGenerated = $event.TimeGenerated
+                $message = $event.Message
+
+                Write-Host "Account locked out: $message at $timeGenerated"
+                Add-Content -Path $using:logFile -Value "Account locked out: $message at $timeGenerated"
+            }
+        } -ArgumentList $username
+    }
+
+    # Wait for 10 seconds (10 seconds)
+    Start-Sleep -Seconds 10
+}