Active Directory User Account Lockout Event Notification

Be notified by email when an Active Directory user account is locked out, this powershell script will grab the most recent lockout event and send you an email notification. Requires a Windows 2008+ domain controller and an email system accepting a relay from the DC.

$Event = Get-EventLog -LogName Security -InstanceId 4740 -Newest 1
 $MailBody= $Event.Message + "r`t" + $Event.TimeGenerated
 $MailSubject= "User Account locked out"
 $SmtpClient = New-Object
 $ = "ExchSvr.Domain.Local"
 $MailMessage = New-Object
 $MailMessage.from = "AcctLockNotify@domain.local"
 $MailMessage.IsBodyHtml = 0
 $MailMessage.Subject = $MailSubject
 $MailMessage.Body = $MailBody

Create a new task in task scheduler to run on an event trigger with event ID 4740. Create a new action to ‘Start a program’ and add this path under program/script:

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -file C:\Scripts\acc_lockout.ps1

When you click ok, task scheduler is smart enough to break the argument up and add them to the correct field.

Before you set it and forget it, go to the General tab and select ‘Run whether user is logged on or not’ and use an account with the proper rights, like your common dedicated service account.

If you’re getting the error:
“File C:\Scripts\acc_lockout.ps1 cannot be loaded because the execution of scripts is disabled on this system. Please see “get-help about_signing” for more details.”, then you will need to turn off the execution policy with:

Set-ExecutionPolicy -0
You should see an email in the following format-
A user account was locked out.
 Security ID:                  S-1-5-18
 Account Name:                 DOMAINCONTROLLER$
 Account Domain:               DOMAINNAME
 Logon ID:                     0x3e7
 Account That Was Locked Out:
 Security ID:                        S-1-5-21-2388021981-560130107-590547658-1106
 Account Name:                 adminuser1
 Additional Information:
 Caller Computer Name:  ServerHost1
 11/08/2012 14:12:29
Disqus Comments Loading...

Recent Posts

FreeNAS Error Creating Pool

command '('gpart', 'create', '-s', 'gpt', '/dev/da8')' returned non-zero exit status 1. If you get this error while trying to create… Read More

June 7, 2019 3:44 pm

Change Grub Default Boot Entry on Linux Mint

I'm dual booting Windows and Linux Mint on my laptop. The grub default is to boot into Linux Mint, however… Read More

April 23, 2019 7:45 pm

How to Reset Secure Channel On Active Directory Domain Controller

When you're a little too careless about virtualizing your domain controllers, cloning, migrating, backing up and restoring, returning from vacation… Read More

April 21, 2019 8:14 am

Run Systemd Script Before System Shutdown

I tried to retain the NGINX FastCGI cache and have it persist across system reboots instead of being ephemeral by… Read More

April 20, 2019 10:14 am

Learn Systemctl Usage to Manage Systemd Service in Linux

Systemd is new service manager for Linux. It's a replacement for all previous init systems (SysV/SysVinit & Ubuntu's Upstart) and… Read More

April 20, 2019 7:55 am

Force Delete Windows Server DHCP Failover Relationship

If you've found yourself here then chances are you messed up one of your domain controllers or at least one… Read More

April 20, 2019 5:54 am