Skip to content

Instantly share code, notes, and snippets.

@orgcontrib

orgcontrib/Get AD account lockout from all DCs.ps1

Created August 23, 2024 20:50
Show Gist options
  • Save orgcontrib/d224ff1ba2749c77692a677d6bb45018 to your computer and use it in GitHub Desktop.
Save orgcontrib/d224ff1ba2749c77692a677d6bb45018 to your computer and use it in GitHub Desktop.
Download ZIP
Get AD account lockout from all DCs.ps1
Raw
Get AD account lockout from all DCs.ps1
## Get all domain controllers for current domain and retrieve AD account lock events, going back a given period in time and showing which account and where it was locked from
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers.name | % { Get-WinEvent -FilterHashtable @{ LogName = 'Security' ; Id = 4740 ; StartTime = [datetime]::Now.AddDays( -7 ) } -ComputerName $_|select timecreated,MachineName,@{n='Account';e={$_.properties[0].value}},@{n='From';e={$_.properties[1].value}}}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment