Public/Get-DCLockoutEvents.ps1
|
function Get-DCLockoutEvents { <# .DESCRIPTION Parse Logs 4740 and 4776 on the PDCEmulator for workstations causing a lockout. Null lockout location events are filtered. Best if run shortly after a lockout. .Parameter Identity Account that is being searched for lockout events .EXAMPLE Get-DCLockoutEvents -identity Joe .Notes Requires The Active Directory Module .Link https://github.com/TheTaylorLee/AdminToolbox #> [CmdletBinding(SupportsShouldProcess)] Param( [Parameter(Mandatory = $True)] [String]$Identity ) #Getting the PDCEmulator $DomainControllers = Get-ADDomainController -Filter * $PDCEmulator = ($DomainControllers | Where-Object { $_.OperationMasterRoles -contains "PDCEmulator" }) #Parsing Event Log 4740 Write-Host "Querying event id 4740 on $PDCEmulator." -BackgroundColor Black -ForegroundColor Yellow $PDCEmulator | ForEach-Object { Get-WinEvent -ComputerName $_ -FilterHashtable @{LogName = 'Security'; Id = 4740 } | Where-Object { ($_.Properties[1].Value -notlike $null -and $_.Properties[0].Value -eq $Identity) } | Select-Object -Property @( @{Label = 'User'; Expression = { $_.Properties[0].Value } } @{Label = 'LockedOutLocation'; Expression = { $_.Properties[1].Value } } @{Label = 'LockedOutTimeStamp'; Expression = { $_.TimeCreated } } @{Label = 'DomainController'; Expression = { $_.MachineName } } @{Label = 'EventId'; Expression = { $_.Id } } ) | Format-Table }#endforeach #Parsing Event Log 4776 Write-Host "Querying event id 4776 on $PDCEmulator; this will take awhile. Use ctrl+c to end at any time." -BackgroundColor Black -ForegroundColor Yellow $PDCEmulator | ForEach-Object { Get-WinEvent -ComputerName $_ -FilterHashtable @{LogName = 'Security'; Id = 4776 } | Where-Object { ($_.Properties[2].Value -notlike $null -and $_.Properties[1].Value -eq $Identity -and $_.KeywordsDisplayNames -contains "Audit Failure") } | Select-Object -Property @( @{Label = 'User'; Expression = { $_.Properties[1].Value } } @{Label = 'BadPasswordLocation'; Expression = { $_.Properties[2].Value } } @{Label = 'BadPasswordAttemptTime'; Expression = { $_.TimeCreated } } @{Label = 'DomainController'; Expression = { $_.MachineName } } @{Label = 'EventID'; Expression = { $_.ID } } ) | Format-Table }#endforeach }#endfunction |