用于获取有关哪台计算机锁定 AD 帐户的信息的 cmdlet

Question

我需要找出哪台计算机正在呼叫锁定我的帐户。我可以通过打开事件查看器并在安全日志中查找日志事件来在 GUI 中做到这一点，但这很耗时，而且由于在我们的环境中这种情况确实经常发生，所以我需要一个更快的解决方案。我写了这个命令：

Get-EventLog security -ComputerName DC -InstanceId 4740 | ? {$_.Message -like "MyUserName"} | FL

我也尝试了-match而不是-like，但都没有给出任何结果。有谁知道使用哪个操作员来获得我需要的东西？

Answer 1

像@vonPryz一样，我通常会使用altools，但它响应帐户被锁定的DC，然后我遇到了下面的代码 https://thesysadminchannel.com/get-account-lock-out-source-powershell/看起来只是票证，先决条件之一是允许查询DC上的远程事件视图访问。

下面复制的网站代码，如果它离线，所有功劳都归功于 Paul 在 SysAdmin 频道：

#requires -Module ActiveDirectory
#Import-Module ActiveDirectory -EA Stop
Function Get-AccountLockoutStatus {
<#
.Synopsis
This will iterate through all your domain controllers by default and checks for event 4740 in event viewer. To use this, you must dot source the file and call the function.
For updated help and examples refer to -Online version.

.DESCRIPTION
This will go through all domain controllers by default and check to see if there are event ID for lockouts and display the information in table with Username, Time, Computername and CallerComputer.
For updated help and examples refer to -Online version.

.NOTES  
Name: Get-AccountLockoutStatus
Author: The Sysadmin Channel
Version: 1.01
DateCreated: 2017-Apr-09
DateUpdated: 2017-Apr-09
.LINK
https://thesysadminchannel.com/get-account-lock-out-source-powershell -

.PARAMETER ComputerName
By default all domain controllers are checked. If a computername is specified, it will check only that.
.PARAMETER Username
If a username is specified, it will only output events for that username.
.PARAMETER DaysFromToday
This will set the number of days to check in the event logs.  Default is 3 days.
.EXAMPLE
Get-AccountLockoutStatus
Description:
Will generate a list of lockout events on all domain controllers.
.EXAMPLE
Get-AccountLockoutStatus -ComputerName DC01, DC02
Description:
Will generate a list of lockout events on DC01 and DC02.
.EXAMPLE
Get-AccountLockoutStatus -Username Username
Description:
Will generate a list of lockout events on all domain controllers and filter that specific user.
.EXAMPLE
Get-AccountLockoutStatus -DaysFromToday 2
Description:
Will generate a list of lockout events on all domain controllers going back only 2 days.
#>
[CmdletBinding()]
param(
[Parameter(
ValueFromPipeline=$true,
ValueFromPipelineByPropertyName=$true,
Position=0)]
[string[]]     $ComputerName = (Get-ADDomainController -Filter * |  select -ExpandProperty Name),
[Parameter()]
[string]       $Username,
[Parameter()]
[int]          $DaysFromToday = 3
)

BEGIN {
$Object = @()
}
PROCESS {
Foreach ($Computer in $ComputerName) {
try {
$EventID = Get-WinEvent -ComputerName $Computer -FilterHashtable @{Logname = 'Security'; ID = 4740; StartTime = (Get-Date).AddDays(-$DaysFromToday)} -EA 0
Foreach ($Event in $EventID) {
$Properties = @{Computername   = $Computer
Time           = $Event.TimeCreated
Username       = $Event.Properties.value[0]
CallerComputer = $Event.Properties.value[1]
}
$Object += New-Object -TypeName PSObject -Property $Properties | Select ComputerName, Username, Time, CallerComputer
}
} catch {
$ErrorMessage = $Computer + " Error: " + $_.Exception.Message
} finally {
if ($Username) {
Write-Output $Object | Where-Object {$_.Username -eq $Username}
} else {
Write-Output $Object
}
$Object = $null
}
}
}     

END {}
}