I want to find out where from a user account is locked out in my domain. <\/p>\n
The manual way to do this would be to open up Event Viewer, scan the event logs on the DC for event ID 4740<\/a>, open it up and see the message to identify the machine from where this account was locked out. But using PowerShell we can obviously automate this way easily!<\/p>\n First things first: how to scan the event logs using PowerShell? You can use either of There’s only one event here so the details of that are returned. It gives us all the info we need at a glance: user name “User01” is locked thanks to a bad password attempt from the computer “MANGO”. <\/p>\n Neat!<\/p>\n Now let’s go about making this prettier and better. <\/p>\n In the code above I am specifying the domain controller to query. That’s only helpful if I have an idea of the machine or site the user is trying to login to, and so know the domain controller responsible for that site. A better approach would be to query the domain controller with the PDC Emulator FSMO role for event ID 4740. This DC is the one that eventually processes the account lockout requests for all accounts<\/em> in the domain<\/a>. <\/p>\n The cmdlet The snippet above returns an object for the DC with the PDC Emulator role, to extract just the name do thus:<\/p>\n Next, let’s go about presenting the output above in a tidier format. <\/p>\n One thing to note is that all the info we want is in a property called So one option would be to do some fancy filtering using This will list out the multiple lockout entries with the timestamp on top in red. <\/p>\n A better option, however, is to use the A one line code that’s way better than opening Event Viewer and filtering through the logs manually.<\/p>\n And if you want to filter by the locked out status of a specific I want to find out where from a user account is locked out in my domain. The manual way to do this would be to open up Event Viewer, scan the event logs on the DC for event ID 4740, open it up and see the message to identify the machine from where this account … Continue reading Find the computer from where an AD account is locked out<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[2],"tags":[4,14,18,26,34,37],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/99"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=99"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/99\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=99"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=99"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=99"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Get-EventLog<\/code> or Get-WinEvent<\/code>. The former only works on the classic event logs while the latter works on both the classic and newer event logs such as those found in Windows Vista and later. I find the latter faster too, so let’s use that. Here’s me running that cmdlet to filter the security logs for event ID 4740 on a remote DC:<\/p>\n\nPS> Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName dc01 | fl *\n\n\nMessage : A user account was locked out.\n\n Subject:\n Security ID: S-1-5-18\n Account Name: DC01$\n Account Domain: ENTERPRISE\n Logon ID: 0x3e7\n\n Account That Was Locked Out:\n Security ID: S-1-5-21-1606980848-515967899-682003330-66682\n Account Name: User01\n\n Additional Information:\n Caller Computer Name: MANGO\nId : 4740\nVersion : 0\nQualifiers :\nLevel : 0\nTask : 13824\nOpcode : 0\nKeywords : -9214364837600034816\nRecordId : 148130232\nProviderName : Microsoft-Windows-Security-Auditing\nProviderId : 54849625-5478-4994-a5ba-3e3b0328c30d\nLogName : Security\nProcessId : 468\nThreadId : 1304\nMachineName : DC01.enterprise.local\nUserId :\nTimeCreated : 23\/05\/2013 09:26:04\nActivityId :\nRelatedActivityId :\nContainerLog : security\nMatchedQueryIds : {}\nBookmark : System.Diagnostics.Eventing.Reader.EventBookmark\nLevelDisplayName : Information\nOpcodeDisplayName : Info\nTaskDisplayName : User Account Management\nKeywordsDisplayNames : {Audit Success}\nProperties : {System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventPrope\n rty, System.Diagnostics.Eventing.Reader.EventProperty, System.Diagnostics.Eventing.Reader.EventP\n roperty...}\n\n<\/pre>\nGet-ADDomainContoller<\/code> gives you the domain controller of the site you are in. Adding the switch -Filter *<\/code> gives you all the domain controllers in the domain. And piping this through a where-object<\/code> to filter out the domain controller with the “PDC Emulator” FSMO role gives you the domain controller we are interested in. Like thus:<\/p>\n\nGet-ADDomainController -Filter * | where-object {$_.OperationMasterRoles -contains \"PDCEmulator\"}\n<\/pre>\n\n(Get-ADDomainController -Filter * | where-object {$_.OperationMasterRoles -contains \"PDCEmulator\"}).Name\n<\/pre>\nMessage<\/code>. <\/p>\n\nPS> Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName dc01 | gm\n\n\n TypeName: System.Diagnostics.Eventing.Reader.EventLogRecord\n\nName MemberType Definition\n---- ---------- ----------\nDispose Method System.Void Dispose()\nEquals Method bool Equals(System.Object obj)\nFormatDescription Method string FormatDescription(), string FormatDescription(System.Collections.Generic.IE...\nGetHashCode Method int GetHashCode()\nGetPropertyValues Method System.Collections.Generic.IList[System.Object] GetPropertyValues(System.Diagnosti...\nGetType Method type GetType()\nToString Method string ToString()\nToXml Method string ToXml()\nMessage NoteProperty System.String Message=A user account was locked out....\nActivityId Property System.Nullable`1[[System.Guid, mscorlib, Version=2.0.0.0, Culture=neutral, Public...\n...\nProperties Property System.Collections.Generic.IList`1[[System.Diagnostics.Eventing.Reader.EventProper...\n...\n\nPS> Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName dc01 | select -ExpandProperty Message\nA user account was locked out.\n\nSubject:\n Security ID: S-1-5-18\n Account Name: DC01$\n Account Domain: ENTERPRISE\n Logon ID: 0x3e7\n\nAccount That Was Locked Out:\n Security ID: S-1-5-21-1606980848-515967899-682003330-66682\n Account Name: User01\n\nAdditional Information:\n Caller Computer Name: MANGO\n<\/pre>\nforeach-object<\/code> like thus:<\/p>\n\nPS> Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName dc01 | %{ write-host -ForegroundColor Red \"At\" $_.TimeCreated; write-host -ForegroundColor White $_.Message; write-host }\nAt 23\/05\/2013 09:26:04\nA user account was locked out.\n\nSubject:\n Security ID: S-1-5-18\n Account Name: DC01$\n Account Domain: ENTERPRISE\n Logon ID: 0x3e7\n\nAccount That Was Locked Out:\n Security ID: S-1-5-21-1606980848-515967899-682003330-66682\n Account Name: User01\n\nAdditional Information:\n Caller Computer Name: MANGO\n<\/pre>\nProperties<\/code> property, which is an array containing exactly the info we want as values.<\/p>\n\nPS> Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName dc01 | select -ExpandProperty Properties\n\nValue\n-----\nUser01\nMANGO\nS-1-5-21-1606980848-515967899-682003330-66682\nS-1-5-18\nDC01$\nENTERPRISE\n999\n\nPS> (Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName dc01).Properties | gm\n\n\n TypeName: System.Diagnostics.Eventing.Reader.EventProperty\n\nName MemberType Definition\n---- ---------- ----------\nEquals Method bool Equals(System.Object obj)\nGetHashCode Method int GetHashCode()\nGetType Method type GetType()\nToString Method string ToString()\nValue Property System.Object Value {get;}\n<\/pre>\nFormat-Table<\/code> is your friend here:<\/p>\n\nPS> Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName (Get-ADDomainController -Filter * | where-object {$_.OperationMasterRoles -contains \"PDCEmulator\"}).Name | `\n ft @{Name=\"User\";Expression={$_.Properties[0].Value}},@{Name=\"Computer\";Expression={$_.Properties[1].Value}},@{Name=\"Time\";Expression={$_.TimeCreated}}\n\n\nUser Computer Time\n---- -------- ----\nUser01 Computer01 23\/05\/2013 12:20:41\nUser02 Computer02 23\/05\/2013 11:55:56\nUser01 Computer01 23\/05\/2013 11:42:40\nUser03 Computer06 23\/05\/2013 11:36:53\nUser01 Computer01 23\/05\/2013 11:03:39\nUser01 Computer01 23\/05\/2013 10:25:37\n<\/pre>\n$user<\/code>, pipe the output through a where-object<\/code> like thus:<\/p>\n\nGet-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -ComputerName (Get-ADDomainController -Filter * | where-object {$_.OperationMasterRoles -contains \"PDCEmulator\"}).Name | `\n Where-Object {$_.Properties[0].Value -match \"$user\"} | `\n ft @{Name=\"User\";Expression={$_.Properties[0].Value}},@{Name=\"Computer\";Expression={$_.Properties[1].Value}},@{Name=\"Time\";Expression={$_.TimeCreated}}\n<\/pre>\n","protected":false},"excerpt":{"rendered":"