Monitor account lockout (in Windows Domain)

Objective

  • Account lockouts can happen when you perform a vulnerability scan with credentials.
  • Account lockouts can happen when you perform brute force password guessing.

Monitor the lockout status is crucial in these situations.

Quick Solution

For a single user (with Powershell)

while(1) 
  {
    Get-ADUser username -Properties * | Select Name, Lockedout, {Date} ; 
    start-sleep 90
  }

Get all locked out accounts in the domain (with Powershell)

Search-ADAccount -LockedOut | 
Select Name, SamAccountName, Enabled, LastLogonDate, LockedOut | 
format-table