If you are in a all-windows shop where everything is nice and neat, everybody has a proper domain membership and all authentication is SSO or Windows Integrated, then you probably do not have much of a problem with repeated account lockouts.
On the other hand, if you are in a mixed environment, lots of :Linux, Mac, and unmanaged Wintendo, then you probably run into some users that manage to Lock themselves out frequently - typically for several days in a row after the account password had been changed.
Reasons can be plenty fold - typically saved credentials somewhere, like a git client, sql-server client, email client, rdp-manager, smbfs-automount, or anything that tries a bunch of logins when you start it up, or keeps trying in the background.
As a sysadmin, you don't have time to narrow it down for the end user - but they will be adamant it is not their fault, so you probably need to prove that "Yes it is" - so I use powershell to grab 4740 events from Domain Controllers, the details of them usually prove the source of the lockout was their machine.
I Separated out the username to make this slightly more readable, you could make an array of parameters to pass it all nice and neat.. One-liners are nice for quick copy and paste though - dont forget to update the domain controller hostname:
This will produce a list of events - it is a bit crude and quick (not much time spent on that regex etc), it shows the event time and the computer that initiated it.
If you want to see the full list you can just do
On the other hand, if you are in a mixed environment, lots of :Linux, Mac, and unmanaged Wintendo, then you probably run into some users that manage to Lock themselves out frequently - typically for several days in a row after the account password had been changed.
Reasons can be plenty fold - typically saved credentials somewhere, like a git client, sql-server client, email client, rdp-manager, smbfs-automount, or anything that tries a bunch of logins when you start it up, or keeps trying in the background.
As a sysadmin, you don't have time to narrow it down for the end user - but they will be adamant it is not their fault, so you probably need to prove that "Yes it is" - so I use powershell to grab 4740 events from Domain Controllers, the details of them usually prove the source of the lockout was their machine.
I Separated out the username to make this slightly more readable, you could make an array of parameters to pass it all nice and neat.. One-liners are nice for quick copy and paste though - dont forget to update the domain controller hostname:
$user="username"
Get-WinEvent -ComputerName yourdomaincontroller.fqdn -LogName Security -FilterXPath "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$user']]" | Select-Object TimeCreated,Message | %{$_ -replace "(?ms)Message=.+Computer Name:",""}
This will produce a list of events - it is a bit crude and quick (not much time spent on that regex etc), it shows the event time and the computer that initiated it.
If you want to see the full list you can just do
$user="username" Get-WinEvent -ComputerName yourdomaincontroller.fqdn -LogName Security -FilterXPath "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$user']]" | FL
Comments
Post a Comment