Where did a User’s Account Get Locked Out?

Updated: May 15, 2015
When this article was originally published, two extra carriage returns were add causing the code to malfunction.  The code below is correct.  

My client for this week’s PowerShell class had a really interesting question. They needed to know where an account is being locked out at. OK, interesting. Apparently users hop around clients and forget to log off, leading to eventual lock out of their accounts. The accounts can be unlocked, but are then relocked after Active Directory replication.
This problem is solved in two parts. The first one is to modify the event auditing on the network. The second part is resolved with PowerShell.
The first part involves creating a group policy that will encompass your Domain Controllers. In this GPO, make these changes.

• Expand Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Management
• Double click User Account Management
• Check Configure the following audit events.
• Check Success

This will allow the domain controllers to audit event 4740 which tells use that an account with locked out. Your users will see something like the image below when their account is locked out.

Once the above GPO has been applied, you will now begin to record lock outs. All accounts currently locked out will not have entries in the Security log until they report another lock out.
The second part is to use PowerShell to parse through all the Security logs on the domain controllers and tell you which client a user’s account was locked out on. This script is designed to be dot sourced or turned into a module. It is heavily commented so it can be used for instruction as well as an actually script in production.

Function Extract-UserName { param (    $StringData )    <#     Extract the username from the log file.      The following line of code performs several tasks.  It receives      a multi line string that is the message data from the event.  This data      is saved in the variable $StringData.  Since this is a [STRING] object      we have access to the methods Split, Replace, and Trim.     - The first operation splits the string into an array of single lines.       This is accomplished with the "Split" method.  The `n tells the       method to split on each new line.     - The next operation take the contents in array index [10]     - The "Replace" method is used to replace the part of the string that we       do not want.  In this case, we are replacing "Account Name:" with $NULL.     - The "Trim" method removes all leading and trailing spaces and leaves       us with just the username.    #>    ((($StringData.Split("`n"))[10]).Replace("Account Name:",$Null)).Trim() } Function Extract-ComputerName { param (    $StringData )    # Extract the computer name from the log file.    Write-Output ((($StringData.Split("`n"))[13]).Replace("Caller Computer Name:",$Null)).Trim() } <# .SYNOPSIS Discovers the client that a user account was locked out on. .DESCRIPTION Returns the client machine which has locked out a user account. See the NOTEs section for setup information. .PARAMETER $User The Name of the User Account that you want to discover the client that locked this account out. .PARAMETER $DaysToSearch This is the number of days to look back in the security logs. The default setting is 14 days. .EXAMPLE Find-LockingClients -user jyoder UserName                      LockingClient                TimeLocked --------                      -------------                ---------- jyoder                        LON-CL1                      8/27/2012 7:02:06 PM jyoder                        LON-CL1                      8/28/2012 8:53:42 PM Returns the clients where the user account -jyoder was locked out. .EXAMPLE Find-LockingClients -User jyoder -DaysToSearch 7 Returns the clients where the user account -jyoder was locked out. This will search the security logs for the past 7 days.  The default is 14 days. .NOTES For the cmdlet to work, advanced auditing needs to be configured on the domain controllers. This can be configured locally or in Group Policy.  It must be done for all Domain Controllers. Category: Account Management Subcategory: User Account Management Audit for: Success #> Function Find-LockingClients { Param(     [cmdletbinding()]     [Parameter(Mandatory=$True)][String]$User = $(Read-Host "Provide a user name"),     [int]$DaysToSearch = 14 )    # Get a list of all of the Domain Controllers    $DCs = Get-ADComputer -Filter * `     -SearchBase "OU=Domain Controllers,$((Get-ADDomain).distinguishedName)"    # Set up the number of days to search in the past.    $StartTime = (Get-Date).AddDays(-($DaysToSearch))    # Create the hash for the event logs.    $LogHash = @{LogName = 'Security';StartTime = $StartTime; ID=4740}    # Store each relevant event in the variable $Events.     ForEach($Item in $DCs)      {       # Error handling just in case on the Domain Controllers       # is offline.       Try        {           Write-Host "Gathering events from"$Item.Name-ForegroundColor Green `            -BackgroundColor DarkMagenta           $Events = Get-WinEvent -FilterHashtable $LogHash `           -ComputerName $Item.Name -ErrorAction Stop |           Sort-Object -Property TimeCreated        }       Catch        {            Write-host "Domain Controller"$Item.Name" if offline" `            -ForegroundColor Red `            -BackgroundColor DarkRed        }       Finally        {             Write-Host $Item.Name"completed" -ForegroundColor Green `             -BackgroundColor DarkMagenta        }      }    # Set up the array to hold multiple sets of data from the event logs.    $EventArray = @()    ForEach ($Event in $Events)     {        # Send the event message data to the functions to extract        # Username and Computer Name.        $UserName = Extract-UserName $Event.Message        $ComputerName = Extract-ComputerName $Event.Message              # Write the data to the object.        $Obj = New-Object -TypeName PSObject        $Obj |Add-Member -MemberType NoteProperty -Name "UserName" -Value $UserName        $Obj |Add-Member -MemberType NoteProperty -Name "LockingClient" -Value $ComputerName        $Obj |Add-Member -MemberType NoteProperty -Name "TimeLocked" -Value $Event.TimeCreated              # Add the individual object to the array of objects.        $Obj | Where-Object {$_.Username -eq $User}     }    # Filter for the user specified in the parameter $User and    # Send the output into the Pipeline.   #$EventArray |Where-Object {$_.UserName -eq $User} }