Rephl3x
c1f5bae1b6
Script allows you to find where the users account was locked out from allowing you to unlock the users account and let them check the server
30 lines
1.2 KiB
PowerShell
30 lines
1.2 KiB
PowerShell
# Binoculars provided by Zak Bearman to Datacom MBIE Platforms team.
|
|
|
|
#Get User XL Format name
|
|
$UN = Read-Host "Enter the username to search for"
|
|
|
|
# Define the username you are searching for
|
|
$username = "$UN" # Replace with the username of the locked-out user
|
|
|
|
# Get all domain controllers in the domain
|
|
$DomainControllers = Get-ADDomainController -Filter * | Select-Object -ExpandProperty HostName
|
|
|
|
# Loop through each domain controller and search for Event ID 4740
|
|
foreach ($DC in $DomainControllers) {
|
|
Write-Host "Checking events on domain controller: $DC"
|
|
|
|
# Use Invoke-Command to remotely query the domain controller using Get-EventLog
|
|
Invoke-Command -ComputerName $DC -ScriptBlock {
|
|
param ($username)
|
|
|
|
# Query the Security event log for Event ID 4740 (Account Lockout)
|
|
$events = Get-EventLog -LogName "Security" -InstanceId 4740 -Newest 1000 | Where-Object { $_.Message -like "*$username*" }
|
|
|
|
foreach ($event in $events) {
|
|
$timeGenerated = $event.TimeGenerated
|
|
$message = $event.Message
|
|
|
|
Write-Host "User was locked out: $message on this DC at $timeGenerated"
|
|
}
|
|
} -ArgumentList $username
|
|
} |