Alert for Specific AD User account lockout

max348

Hi

I need help in setting up the alert for a specific users when his/her account gets locked out.

Currently i am monitoring the event ID 4740 which sends me a alert whenever the event is generated with the message showing all the details of account lockout.

I have a requirement now asking to trigger alert when a certain user account gets locked out. Is there way we can get this done?

thulsey

You're on the right track by monitoring Event ID 4740. To do what you're wanting, you'll probably have to use Powershell. Here's a quick something I've whipped up for you. It's untested but you get the idea.

$lockout = Get-EventLog -Log security | where {$_.eventID -eq 4740} | Sort-Object index -Descending | select -first 1
if ($lockout.message -like "*JohnDoe*"){

     Write-Host "Statistic.lockout: 1"

}