Want create site? Find Free WordPress Themes and plugins.

This post answers questions such as:

  • How do I track the source of account lockouts?
  • My account locks out every XX minutes, how do I resolve it?
  • How can I find out which computer is locking out an account?
track the source of account lockout
Account Lockout

Does this picture look familiar?

To some it happens when you type your password wrongly a number of time (depends on the Lockout policy set in AD) and in some very rare and troublesome cases, it happens persistently, and it becomes frustrating finding out where it’s happening. One of the most troublesome issues I’ve ever faced in my server administration “ministry” is the issue of tracking the source of an account lockout. Once upon a time, my account began locking out every twenty minutes, and you can imagine how frustrating that can be, even as an IT administrator.

I tried Account Lockout Status from Microsoft. It didn’t work (I wonder why). I even tried my favourite lockout tracking tool –  Netwrix Lockout Examiner (trust me, this guy was difficult to install/configure), but for some reason, it didn’t work too!

After a lot of scouring the web, gathering information here and there, I discovered a PowerShell script that could just do the trick (please if you remember the source, you may leave a comment and I’ll cite it). This script tells you the exact computer that an account originates from. It queries the event log of the Primary Domain Controller (PDC) of your domain for events with ID = 4740 and a username you specify. I’ve edited the script a bit.

This script must be run in the Primary Domain Controller.

How to track the source of account lockouts (3 steps)

  1. Run Powershell in your PDC. (You can also execute remotely if you have enabled Remote Code Execution on your PDC)
  2. Save the code below as a Powershell file (extension .ps1)
  3. Run the Powershell script. You may have to change your Execution Policy to enable unsigned scripts or self-sign the script.

## This script finds out the PC that an account is locking out
## Define the username that’s locked out
$Username = ‘enter your user name here. Make sure to include the single quotes!’
## Find the domain controller PDCe role
$Pdce = (Get-AdDomain).PDCEmulator
## Build the parameters to pass to Get-WinEvent
$GweParams = @{
‘Computername’ = $Pdce
‘LogName’ = ‘Security’
‘FilterXPath’ = “*[System[EventID=4740] and EventData[Data[@Name=’TargetUserName’]=’$Username’]]”
}
## Query the security event log
$Events = Get-WinEvent @GweParams
$Events | foreach {$_.Properties[1].Value}

Wait for it to execute. Its speed would depend on the size of your event logs.

Hopefully this helps someone else resolve that persistent account lockout.

If you have any issues, please leave a comment.

Did you find apk for android? You can find new Free Android Games and apps.
SHARE

Leave a Reply