Script pour retrouver l’heure et l’origine du verrouillage d’un compte AD

Le script doit être lancé depuis un poste avec les modules powershell Active directory.

Le compte qui exécute ce script doit avoir les droits sur les journaux des contrôleurs de domaine.

$elapsedTime = [system.diagnostics.stopwatch]::StartNew()

$cred = Get-Credential


$Accountdomain = read-host "Enter account name with domain name  Domain\Account"
$domain = ($Accountdomain.Split("\\"))[0]
$account =($Accountdomain.Split("\\"))[1]

if ($domain -eq $null -or ($account -eq $null))
{
	Write-Host "Account has not been type correctly . Please retry with format DOMAIN\ACCOUNT"
	exit
}

	

$pdc = (Get-ADDomain -Server $domain  | Select-Object PDCEmulator).pdcemulator

$LastBadPasswordDate = (Get-ADUser $Account  -Server $pdc -Properties LastBadPasswordAttempt ).LastBadPasswordAttempt 
if ($LastBadPasswordDate -eq "$null")
{
	Write-Host "Account " $account " has not found in domain "$domain
	exit
}
$LastBadPasswordAttemptBefore = $LastBadPasswordDate.AddHours(1)
$LastBadPasswordAttemptAfter=$LastBadPasswordDate.AddHours(-1)

$events = Get-WinEvent -FilterHashtable @{LogName="Security";ID=4740;StartTime=$LastBadPasswordAttemptAfter;EndTime=$LastBadPasswordAttemptBefore} -ComputerName $pdc -Credential $cred
$result =$null
$result=@()

foreach ($event in $events)
{
	if ($event.message -match "$Account")
       {

         47
        $eventfound = $event.message -split "`n"
        $accountfound = $eventfound | Select-String -Pattern "Caller Computer Name"
        $resultaccount =($accountfound.line -split "	")[2]

        $result += "Locked from Computer : "+$resultaccount+ " at "+$event.TimeCreated +"`n"
       }
 }
 Write-Host $result
 $elapsedTime.stop()
 
 write-host $([string]::Format("Time Elapsed: {0:d2}:{1:d2}:{2:d2}", $elapsedTime.Elapsed.hours, $elapsedTime.Elapsed.minutes, $elapsedTime.Elapsed.seconds))

$elapsedTime = [system.diagnostics.stopwatch]::StartNew()

$cred = Get-Credential

$Accountdomain = read-host "Enter account name with domain name Domain\Account"

$domain = ($Accountdomain.Split("\\"))[0]

$account =($Accountdomain.Split("\\"))[1]

if ($domain -eq $null -or ($account -eq $null))

{

Write-Host "Account has not been type correctly . Please retry with format DOMAIN\ACCOUNT"

exit

}

$pdc = (Get-ADDomain -Server $domain | Select-Object PDCEmulator).pdcemulator

$LastBadPasswordDate = (Get-ADUser $Account -Server $pdc -Properties LastBadPasswordAttempt ).LastBadPasswordAttempt

if ($LastBadPasswordDate -eq "$null")

{

Write-Host "Account " $account " has not found in domain "$domain

exit

}

$LastBadPasswordAttemptBefore = $LastBadPasswordDate.AddHours(1)

$LastBadPasswordAttemptAfter=$LastBadPasswordDate.AddHours(-1)

$events = Get-WinEvent -FilterHashtable @{LogName="Security";ID=4740;StartTime=$LastBadPasswordAttemptAfter;EndTime=$LastBadPasswordAttemptBefore} -ComputerName $pdc -Credential $cred

$result =$null

$result=@()

foreach ($event in $events)

{

if ($event.message -match "$Account")

{

$eventfound = $event.message -split "`n"

$accountfound = $eventfound | Select-String -Pattern "Caller Computer Name"

$resultaccount =($accountfound.line -split " ")[2]

$result += "Locked from Computer : "+$resultaccount+ " at "+$event.TimeCreated +"`n"

}

Write-Host $result

$elapsedTime.stop()

write-host $([string]::Format("Time Elapsed: {0:d2}:{1:d2}:{2:d2}", $elapsedTime.Elapsed.hours, $elapsedTime.Elapsed.minutes, $elapsedTime.Elapsed.seconds))

Leave a Reply Cancel reply