Powershell script

Question

Powershell script

Louai Al Obaidi 0

Hello,

I need a powershell script that when AD user account is locked out the admin will get a notification email.

Thank you.

anza 856 Reputation points

2023-10-05T15:35:38.48+00:00
should not be to hard, there are 2 parts

lock-out triggers eventid:4740 in windows event log (security) of AD with PDC Emulator Role
from this event you can grab more information to include in email

sending email based on specifics of your environment which you did not specify (you have internal smtp server like ms-exchange or you use exchange-online or even some 3rd party mail provider)

so what to do is to

attach a task to the security eventid 4740 in event viewer

make the task calls a powershell script that

reads important information about last lockout
use: Get-EventLog -Logname Security -InstanceID 4740 -Newest 1 #this should give you the latest lock-out event that triggered the task
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog

sends collected information to admin(s) via email
Send-MailMessagecan handle different scenarios
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage

this is it for now, don't want to spoil all the fun in you building it

regards

1 answer

Your answer

anza 856 Reputation points

2023-10-05T15:35:38.48+00:00

should not be to hard, there are 2 parts

lock-out triggers eventid:4740 in windows event log (security) of AD with PDC Emulator Role
from this event you can grab more information to include in email

sending email based on specifics of your environment which you did not specify (you have internal smtp server like ms-exchange or you use exchange-online or even some 3rd party mail provider)

so what to do is to

attach a task to the security eventid 4740 in event viewer

make the task calls a powershell script that

reads important information about last lockout
use: Get-EventLog -Logname Security -InstanceID 4740 -Newest 1 #this should give you the latest lock-out event that triggered the task
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog

sends collected information to admin(s) via email
Send-MailMessagecan handle different scenarios
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage

this is it for now, don't want to spoil all the fun in you building it

regards

Answer 1

Rich Matheisen 47,901

You can try this:

https://community.spiceworks.com/scripts/show/2471-account-lock-out-email-script-server-2008-r2-and-newer

You don't say whether you want an immediate notification or one that sends a message periodically and includes all the lockouts since the last run. It makes a difference!

Share via

Powershell script

I need a powershell script that when AD user account is locked out the admin will get a notification email.

1 answer

Your answer