Active Directory Report or Log

[Breaker187]

Does anyone know of a way to setup either a log or pull a report that can indicate when(date/time) users on AD have locked their account, how would be nice but not important. Also more importantly a log/report of who and when that account was unlocked?
We running AD 2008 if that helps.

Thanx

 

[phiber]

Theres some cool tools that does this, have you check out getting a SCOM agent? It does a lot more. You can also use EventCombMT, think its free. Download that and it can scan your logs for certain even IDs

 

[Breaker187]

I've found something literally after posting the question and it happenend to be on a 2nd google page
Basically filter the event log on the DC for event id 4676 - gives the information I was after.
But ofcourse its never quite as simple, so the nice to have has now become important - what cause the account to be locked.
I'm aware there are many tools one could buy, I just thought that before we go that route to check what we have.

 

[srothman]

Learn Powershell. Can do all sorts of amazing things with it.

 

[jeorgebook]

Please refer to this link. Hope it works for you.

http://mikefrobbins.com/2011/10/06/find-ad-user-account-lockout-events-with-powershell/

 

[noosphere]

hi Breaker

have a look at this link, it has some AD queries that are useful to have. Also as someone previously mentioned, if you find yourself doing the same tasks on a regular basis you might want to learn Powershell to automate some jobs.

Link Below:

http://www.kreslavsky.com/2008/08/active-directory-saved-queries-templates.html

 

[Breaker187]

Thanx for the input guys, I'll be checking those links out.