{Pro-Active} Account lockouts alert

katos

We use a similar script to the below to alert of account lockouts so that the helpdesk can provide pro-active support for users, this drastically increased our user satisfaction in our latest IT Forums, and allows us to catch issues before they become worse (emails failing to send, case management system lockouts, etc.)

# Email into the helpdesk to alert pro-actively of any account lockouts

Start-Transcript -path "c:\lockoutlog.txt" -append

$AccountLockOutEvent = Get-EventLog -LogName "Security" -InstanceID 4740 -Newest 1
$LockedAccount = $($AccountLockOutEvent.ReplacementStrings[0])
$AccountLockOutEventTime = $AccountLockOutEvent.TimeGenerated.ToLongDateString() + " " + $AccountLockOutEvent.TimeGenerated.ToLongTimeString()
$AccountLockOutEventMessage = $AccountLockOutEvent.Message

if ( $LockedAccount -ne "Guest" )
{ send-mailmessage $email
}
Stop-Transcript