51 lines
2.2 KiB
PowerShell
51 lines
2.2 KiB
PowerShell
## Created by Zak Bearman - Intel - Datacom - For use on any domain that WinRM is enabled and supported for remote log searching##
|
|
cls
|
|
# Define the username you are searching for
|
|
$username = read-host "Please enter users account" # Replace with the username of the locked-out user
|
|
# Get the PDC Emulator
|
|
$pdcemulator = (Get-ADDomain).PDCEmulator
|
|
$DomainControllers = Get-ADDomainController $pdcemulator | Select-Object -ExpandProperty HostName
|
|
|
|
# Define log file path
|
|
$logFile = "C:\Temp\AccountLockoutLog.txt"
|
|
|
|
# Create the log file if it doesn't exist
|
|
if (-not (Test-Path $logFile)) {
|
|
New-Item -Path $logFile -ItemType File -Force
|
|
}
|
|
|
|
# Loop indefinitely every 5 minutes
|
|
while ($true) {
|
|
foreach ($DC in $DomainControllers) {
|
|
Write-Host "Searching on: $DC"
|
|
Add-Content -Path $logFile -Value "Searching on: $DC - $(Get-Date)"
|
|
|
|
# Use Invoke-Command to remotely query the domain controller
|
|
Invoke-Command -ComputerName $DC -ScriptBlock {
|
|
param ($username)
|
|
|
|
# Query the Security event log for Event ID 4625 (Failed Login Attempt)
|
|
$events4625 = Get-EventLog -LogName "Security" -InstanceId 4625 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
|
|
foreach ($event in $events4625) {
|
|
$timeGenerated = $event.TimeGenerated
|
|
$message = $event.Message
|
|
|
|
Write-Host "Failed login attempt: $message at $timeGenerated"
|
|
Add-Content -Path $using:logFile -Value "Failed login attempt: $message at $timeGenerated"
|
|
}
|
|
|
|
# Query the Security event log for Event ID 4740 (Account Lockout)
|
|
$events4740 = Get-EventLog -LogName "Security" -InstanceId 4740 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
|
|
foreach ($event in $events4740) {
|
|
$timeGenerated = $event.TimeGenerated
|
|
$message = $event.Message
|
|
|
|
Write-Host "Account locked out: $message at $timeGenerated"
|
|
Add-Content -Path $using:logFile -Value "Account locked out: $message at $timeGenerated"
|
|
}
|
|
} -ArgumentList $username
|
|
}
|
|
|
|
# Wait for 10 seconds (10 seconds)
|
|
Start-Sleep -Seconds 10
|
|
} |