Files
Work-Tools/Binoculars.ps1

51 lines
2.2 KiB
PowerShell

## Created by Zak Bearman - Intel - Datacom - For use on any domain that WinRM is enabled and supported for remote log searching##
cls
# Define the username you are searching for
$username = read-host "Please enter users account" # Replace with the username of the locked-out user
# Get the PDC Emulator
$pdcemulator = (Get-ADDomain).PDCEmulator
$DomainControllers = Get-ADDomainController $pdcemulator | Select-Object -ExpandProperty HostName
# Define log file path
$logFile = "C:\Temp\AccountLockoutLog.txt"
# Create the log file if it doesn't exist
if (-not (Test-Path $logFile)) {
New-Item -Path $logFile -ItemType File -Force
}
# Loop indefinitely every 5 minutes
while ($true) {
foreach ($DC in $DomainControllers) {
Write-Host "Searching on: $DC"
Add-Content -Path $logFile -Value "Searching on: $DC - $(Get-Date)"
# Use Invoke-Command to remotely query the domain controller
Invoke-Command -ComputerName $DC -ScriptBlock {
param ($username)
# Query the Security event log for Event ID 4625 (Failed Login Attempt)
$events4625 = Get-EventLog -LogName "Security" -InstanceId 4625 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
foreach ($event in $events4625) {
$timeGenerated = $event.TimeGenerated
$message = $event.Message
Write-Host "Failed login attempt: $message at $timeGenerated"
Add-Content -Path $using:logFile -Value "Failed login attempt: $message at $timeGenerated"
}
# Query the Security event log for Event ID 4740 (Account Lockout)
$events4740 = Get-EventLog -LogName "Security" -InstanceId 4740 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
foreach ($event in $events4740) {
$timeGenerated = $event.TimeGenerated
$message = $event.Message
Write-Host "Account locked out: $message at $timeGenerated"
Add-Content -Path $using:logFile -Value "Account locked out: $message at $timeGenerated"
}
} -ArgumentList $username
}
# Wait for 10 seconds (10 seconds)
Start-Sleep -Seconds 10
}