Find why an account is getting locked out and where
Many a times there comes a request that a user complains that an account is getting locked out for no apparent reason and it’s hard to pinpoint where it is getting locked out from.
I was trying to find out why a user account is getting locked out and where but needed to go through logs to find out my answer. Once the machine name was found, it’s a matter of reviewing services, scheduledtasks, or similar items to see where an account name and password were hardcoded.
I was able to utilize the following script to provide an answer.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 |
#Get-LockedOutStatus.ps1 $Identity = "mwasay" #The samAccountName of the user that is getting locked out $DCCounter = 0 $LockedOutStats = @() #Get all domain controllers in domain $DomainControllers = Get-ADDomainController -Server yourdomain.com -Filter * #Update your domain name here $PDCEmulator = ($DomainControllers | Where-Object { $_.OperationMasterRoles -contains "PDCEmulator" }) Write-Verbose "Finding the domain controllers in the domain" Foreach ($DC in $DomainControllers) { $DCCounter++ Write-Progress -Activity "Contacting DCs for lockout info" -Status "Querying $($DC.Hostname)" -PercentComplete (($DCCounter / $DomainControllers.Count) * 100) Try { $UserInfo = Get-ADUser -Identity $Identity -Server $DC.Hostname -Properties AccountLockoutTime, LastBadPasswordAttempt, BadPwdCount, LockedOut -ErrorAction Stop } Catch { Write-Warning $_ Continue } If ($UserInfo.LastBadPasswordAttempt) { $LockedOutStats += New-Object -TypeName PSObject -Property @{ Name = $UserInfo.SamAccountName SID = $UserInfo.SID.Value LockedOut = $UserInfo.LockedOut BadPwdCount = $UserInfo.BadPwdCount BadPasswordTime = $UserInfo.BadPasswordTime DomainController = $DC.Hostname AccountLockoutTime = $UserInfo.AccountLockoutTime LastBadPasswordAttempt = ($UserInfo.LastBadPasswordAttempt).ToLocalTime() } }#end if }#end foreach DCs $LockedOutStats | Format-Table -Property Name, LockedOut, DomainController, BadPwdCount, AccountLockoutTime, LastBadPasswordAttempt -AutoSize #Get User Info Try { Write-Verbose "Querying event log on $($PDCEmulator.HostName)" $LockedOutEvents = Get-WinEvent -ComputerName $PDCEmulator.HostName -FilterHashtable @{LogName = 'Security'; Id = 4740 } -ErrorAction Stop | Sort-Object -Property TimeCreated -Descending } Catch { Write-Warning $_ Continue }#end catch Foreach ($Event in $LockedOutEvents) { If ($Event | Where-Object { $_.Properties[2].value -match $UserInfo.SID.Value }) { $Event | Select-Object -Property @( @{Label = 'User'; Expression = { $_.Properties[0].Value } } @{Label = 'DomainController'; Expression = { $_.MachineName } } @{Label = 'EventId'; Expression = { $_.Id } } @{Label = 'LockedOutTimeStamp'; Expression = { $_.TimeCreated } } @{Label = 'Message'; Expression = { $_.Message -split "`r" | Select-Object -First 1 } } @{Label = 'LockedOutLocation'; Expression = { $_.Properties[1].Value } } ) }#end ifevent }#end foreach lockedout event }#end process }#end function |
