1

I will like to email the SysAdmin event id 4625 (Account lockout) occurs.

I have the following code, and it works just find. See output attachedenter image description here:

Current code: 

$AccountLockOutEvent = Get-EventLog -LogName "Security" -InstanceID 4625 -Newest 1
$LockedAccount = $($AccountLockOutEvent.ReplacementStrings[0])
$AccountLockOutEventTime = $AccountLockOutEvent.TimeGenerated
$AccountLockOutEventMessage = $AccountLockOutEvent.Message
$messageParameters = @{ 
Subject = "Account Locked Out: $LockedAccount" 
Body = "Account $LockedAccount was locked out on $AccountLockOutEventTime..`n`nEvent 
Details:`n`n$AccountLockOutEventMessage"
From = "" 
To = "" 
SmtpServer = ""
} 
Send-MailMessage @messageParameters

Question to Powershell gurus

1 - How can I capture the exact reason for lockout instead of %%2313 and other information such as the samaccountname. Instead using Account locked out s-1-0-0 in the subject line, I want to see the Account name there.
2 - is there a way get the ADuser information so that we can email the user at thesame time informing that that their account was locked out to contact the SysAdmin to unlock the account?

Sunny J
  • 453
  • 2
  • 14
  • 1
    Question: 2. If their account is locked out, how are they going to be able to log in to check their email, and read the message that their account got locked out? – HAL9256 Feb 07 '20 at 23:55
  • That's a good question. The email address used during account creation is always different from the AD account domain. To be brief they are of two separate domains. Example: their AD account is demo@abc.com and their email is demo@xyz.com. So, I'd like to send the email to the xyz.com – Sunny J Feb 08 '20 at 01:02

1 Answers1

0

You can use this snippet to get an output that contains the fields you need. SubjectUserName and SubjectDomainName.

$events = Get-WinEvent -FilterHashtable @{logname='Security'; ID=4625; } -MaxEvents 1 
$event = $events
[xml]$eventXML = [xml]$Event.ToXml()
$eventXML.Event.EventData.Data

Output will look like this.

Name              #text       ----              -----   
SubjectUserSid    S-0-0-00-0000000000-0000000000-0000000000-0000       
SubjectUserName   MyUsername      
SubjectDomainName MyHostname           
SubjectLogonId    0x00000000           
PrivilegeList     SeSecurityPrivilege
Zucchini
  • 459
  • 6
  • 16