Youtor
Troubleshooting account lockouts in Active Directory
>> YOUR LINK HERE: ___ http://youtube.com/watch?v=d09p5T4O-GI
In this video, I'll talk about how you can troubleshoot account lockout issues in Active Directory and find the source of account lockouts such as computers, programs or other types of devices. • I'll show you how can use Security Logs in Event Viewer to view the lockout events, enable additional audit policies on default domain controller policy, debug using Netloggin logging, Powershell Script Account Lockout Status (GUI tool) to find the source of account lockouts. • Table of Contents: • 00:00 - Intro • 00:25 - Understanding Account Lockout Policy in AD • 04:00 - How to check if user accounts are locked in AD? • 06:20 - Unlock User Accounts in AD • 07:17 - Troubleshooting account lockout events using Event Viewer • 12:21 - Extend the size of security log in Event Viewer • 13:32 - Find unknown computer/device in Security Events (Event ID 4770) • 17:04 - Event ID 4625 | NTLM Authentiction • 18:30 - Using NetLogon debugging • 20:06 - Using PowserShell Script on PDC Emulator to find the source of account lockouts • 21:09 - Using PowerShell script on all domain controller to find the source of account lockouts • 21:26 - Using Account Lockout Status to find the source of account lockouts • 23:17 - Troubleshoot using Process Tracking to find the process locking the user accounts. • The below PS script finds the events with an Event ID 4740 and returns the lockout time and the name of the computer from which it occurred: • $Usr = ‘Michael.Greene’ • $Pdc = (Get-AdDomain).PDCEmulator • $ParamsEvn = @{ • ‘Computername’ = $Pdc • ‘LogName’ = ‘Security’ • ‘FilterXPath’ = *[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Usr']] • } • $Evnts = Get-WinEvent @ParamsEvn • $Evnts | foreach {$_.Properties[1].value + ' ' + $_.TimeCreated} • If you want to search all domain controllers, then you can use the below script in PowerShell. • $Usr = ‘username1’ • Get-ADDomainController -fi * | select -exp hostname | % { • $ParamsEvn = @{ • ‘Computername’ = $Pdc • ‘LogName’ = ‘Security’ • ‘FilterXPath’ = *[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Usr']] • } • $Evnts = Get-WinEvent @ParamsEvn • $Evnts | foreach {$_.Computer + +$_.Properties[1].value + ' ' + $_.TimeCreated} • } • Download Account Lockout Status - https://www.microsoft.com/en-in/downl...
#############################
