At a company where I worked, there was no logging with account lock and the had plans to change the GPO that accounts will not be auto unlocked.
So I also added mailing to the admin of that specific OU (Country)
I found a script from Maxzor1908 on Technet
That was the basic. I Added a lot of extra.
# Powershell User Account locked out Maxzor1908 *16/4/2013*
# Checked and edit by Daag van der Meer - 03-10-2018
# blog.van-daag.nl
# Email adress needs to be filled in at the admin account.
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\Lockedhtml.html"
##################
## Log location
##################
$log= "C:\Logs\AccountLocked.csv"
$HTML=@"
<title>Account locked out Report</title>
<!--mce:0-->
"@
$Account_Name = @{n='Account name';e={$_.ReplacementStrings[-1]}}
$Account_domain = @{n='Account Domain';e={$_.ReplacementStrings[-2]}}
$Caller_Computer_Name = @{n='Caller Computer Name';e={$_.ReplacementStrings[-1]}}
##################
## Retrieve eventlog with all value
##################
$event= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 |
Select TimeGenerated,ReplacementStrings,"Account name","Account Domain","Caller Computer Name" |
% {
New-Object PSObject -Property @{
"Account name" = $_.ReplacementStrings[-7]
"Account Domain" = $_.ReplacementStrings[5]
"Caller Computer Name" = $_.ReplacementStrings[1]
Date = $_.TimeGenerated
}
}
$event | ConvertTo-Html -Property "Account name","Account Domain","Caller Computer Name",Date -head $HTML -body "<H2> User is locked in the Active Directory</H2>"|
Out-File $Report -Append
##################
## Retrieve eventlog For filter username
##################
$user= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 |
Select ReplacementStrings |
% {
New-Object PSObject -Property @{
"Account name" = $_.ReplacementStrings[-7]
}
}
$userrename = $user -replace ".*=" -replace "}"
$userou = Get-ADUser $userrename -Properties DistinguishedName | Select-Object -ExpandPropert DistinguishedName
##############################
## Here is the ad Groups configured who can unlock accounts
#############################
if ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}
elseif ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}
else {$mail = "<AD GROUP>" }
$adminmail = Get-ADGroupMember $mail | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail} | %{write-output "$($_.mail)"}
$mailadmin = $adminmail -join "," -replace ",,"
##################
## Mail config admin
##################
$MailBody= Get-Content $Report
$MailSubject= "User Account locked out"
$SmtpClient = New-Object system.net.mail.smtpClient
$SmtpClient.host = "<MAIL SERVER>"
$MailMessage = New-Object system.net.mail.mailmessage
$MailMessage.from = "<FROM MAIL ADRESS>"
$MailMessage.To.add("<TO MAIL ADRESS>,$mailadmin")
$MailMessage.Subject = $MailSubject
$MailMessage.IsBodyHtml = 1
$MailMessage.Body = $MailBody
$SmtpClient.Send($MailMessage)
##################
## Remove the temp document
##################
del c:\Temp\Lockedhtml.html
##################
## Write to log about the account lock
##################
$event | Export-Csv $log -NoTypeInformation -Append