I hate it when a user is locked out every few minutes. It’s like where are they locking out!? If you have an AD auditor, you can simply look into those logs and see. How about if you don’t? The next option is to look through the logs on all of your DCs… Yeah, that can take a long time. So, why not use PowerShell? Oh yeah. This is the good stuff here. Lets dive in.

The Script

Function Get-LockInfo {
    [cmdletbinding()]
    param (
        [String]$Username,
        [int]$DaysBack = 2
    )
    $EndTimeStamp = (Get-Date)
    $Return = @()
    $FilterTable = @{
            'StartTime' = ((Get-date).AddDays(-($DaysBack)))
            'LogName' = 'Security'
            'Id' = 4740
    }
    $Servers = (Get-DomainController).name
    foreach ($Server in $Servers) {
        $Events = Get-WinEvent -ComputerName $Server -FilterHashtable $FilterTable -ErrorAction SilentlyContinue 
    }
    
    foreach ($Event in $Events) {
        if ($Event.Properties[0].value -like "$username") {
            $Return += [pscustomobject][ordered]@{
                Time = $Event.TimeCreated
                DC = $Event.Properties[4].value
                Username = $Event.Properties[0].value
                Computer = $Event.Properties[1].value
            }
        }
    }
    $Return
}

The Breakdown

Phew, this is a big one that does a lot. Let’s break it down. The first thing we grab is the username and how many days you want to go back. I always do it for 2 days. Then we grab the current date. We do this because we don’t want any information after now. Sometimes that can get you locked down. Next, we create the arrays to hold everything together. We create a return to holding all the return information and events to hold the events we will be filtering through.

Now we build the filter table. We will use this table later down to search through the windows events. So we start the filter table with a @{}. We place the starttime, endtime, logname, and ID. The Log name and ID are very important. The start time gives us when we start. Notice we are using the Days Back variable to look in the past. Get-date gives us the current date and then we add days backward. The Log names that we are targeting are the security logs because that’s where failed logins will live. The ID is 4740. There is a good site that gives you good information on which logs are which. Windows Security Log Encyclopedia.

Next we grab the DC servers. Normally you can just search the server with the FDC, however, not all worlds are the same. So, in our network, one server handles windows logins, another server handles application logins. Yeah, I know that’s pretty dumb, and how did they set it up right? Anyways, We use the Get-ADDomainController command to grab those servers.

Then we start looping. This is where the events variable comes in. We add the Get-winevent data into $events. Notice we target the server and then we use that filter table from earlier. This is the part that takes the longest time.

Now we have our events, it’s time to filter threw them and grab information. We search each event to see if the properties of 0 is the username. Notice we use like instead of eq. We do this because eq is case sensitive. If we find that username, we put that information into the return array. Some people like to just display the information, I like having in cups. So we create our ps object and we order the object. We grab the time created. We grab which DC the log is coming from, the username, and the “computer” it is coming from. Notice I say “Computer” because that is sometimes non-reflective. A lockout on an email on a phone is oftentimes shown as the server name. Same way with some applications, they will respond back to the server it lives. Finally, we return the information.

There are some restrictions on this command. The first is, if the log doesn’t exist, it doesn’t exist. There are only so many logs the system will hold until it writes over the logs.

Thank you for your time. If you have any questions feel free to ask away.