AD user locked out alert using SAM

There are other tools that can do this like ADAudit Plus but I believe this can be setup as a script on your AD controller.

https://www.sealingtech.com/2017/05/22/sending-automatic-email-notifications-when-an-active-directory-account-locks/

https://community.spiceworks.com/t/email-the-helpdesk-when-domain-user-is-locked-out/768323/5

https://www.linkedin.com/pulse/useful-script-send-email-notification-account-lockout-arafa/

Have you tried making a single SAM template for just this condition and deploying it? When an Active Directory user account is locked, an account lockout event ID is added to the Windows event logs. Event ID 4740 is added on domain controllers and the event 4625 is added to client computers.

I suspect this is what they have done but the problem is the alert/component monitor will show all the events collected in the last X time period. I'm not sure how they would go about it in SAM to get 1 email per user unless only 1 user was being locked out per polling collection interval. 

Good point. We only use this for Service Accounts, so it does not happen often enough to worry about multiple lockouts per polling period, however this may a weak point in our setup if multiple lock up. That said, whenever a Service Account locks up an alert is generated people are on it right away so those events are short lived. Perhaps at least collect the data via SAM or one of the Log engines and use a Custom SWQL alert against the DB table if you need to do something outside of what SW does out of the box? 

KOHLIfied said:

Hi Folks,

I am using SAM module and I wanted to get notified whenever a user account is locked out, with username and workstation info.

I have tried to achieve this by active directory templates, but is is giving loads of event message in single email. I want a one email with per user.

Can someone please help me with this requirement

Regards,

Akash

Hi Akash,

To achieve a single email per user for account lockout notifications, you can configure your alerting system to aggregate lockout events based on username. Use a script or custom rule that checks for account lockouts, collects the necessary details (like username and real estate marketing), and sends a consolidated email per user rather than flooding you with multiple alerts. You might need to adjust your template or notification settings to handle this aggregation properly.

Hi Guys,

Thank you for your valuable suggestions.

EmmaClaire , do you have such kind of script or alert in your environment, if yes than can you please post it here. This will be really helpful.

Regards,

Akash

How

A big reminder that Server & Application Monitor  is a performance based monitoring tool. It'll do a good job of counting how many lock out events have occurred over X time, but it isn't great at pulling the individual details over each event. This request would be better suited in an event based tool.

The Log Analyzer module (also available in SolarWinds Observability Self-Hosted (formerly known as Hybrid Cloud Observability) ) and part of the same platform that SAM can be installed with, can pull each Windows EventID and alert against it. It does this by installing an agent on those server(s). This would be the better route in monitoring lock out events that would include the username and workstation info.

If you're looking for another platform, not directly associated with the SolarWinds Platform, Security Event Manager (SEM) does this too and adds other security and auditing capabilities.

Hi, currently I don't have but I will share once I get it.