revert my changes

My reformating broke the code
This commit is contained in:
Andreas Zweili 2017-07-15 10:35:42 +02:00
parent 7708a20756
commit 306e3f6d80
1 changed files with 34 additions and 69 deletions

View File

@ -3,17 +3,12 @@ Function Get-LockedOutLocation
{ {
<# <#
.SYNOPSIS .SYNOPSIS
This function will locate the computer that processed a failed This function will locate the computer that processed a failed user logon attempt which caused the user account to become locked out.
user logon attempt which caused the user account to become locked
out.
.DESCRIPTION .DESCRIPTION
This function will locate the computer that processed a failed This function will locate the computer that processed a failed user logon attempt which caused the user account to become locked out.
user logon attempt which caused the user account to become locked The locked out location is found by querying the PDC Emulator for locked out events (4740).
out. The locked out location is found by querying the PDC Emulator The function will display the BadPasswordTime attribute on all of the domain controllers to add in further troubleshooting.
for locked out events (4740). The function will display the
BadPasswordTime attribute on all of the domain controllers to add
in further troubleshooting.
.EXAMPLE .EXAMPLE
PS C:\>Get-LockedOutLocation -Identity Joe.Davis PS C:\>Get-LockedOutLocation -Identity Joe.Davis
@ -21,16 +16,14 @@ Function Get-LockedOutLocation
This example will find the locked out location for Joe Davis. This example will find the locked out location for Joe Davis.
.NOTE .NOTE
This function is only compatible with an environment where the This function is only compatible with an environment where the domain controller with the PDCe role to be running Windows Server 2008 SP2 and up.
domain controller with the PDCe role to be running Windows Server The script is also dependent the ActiveDirectory PowerShell module, which requires the AD Web services to be running on at least one domain controller.
2008 SP2 and up. The script is also dependent the ActiveDirectory Author:Jason Walker
PowerShell module, which requires the AD Web services to be
running on at least one domain controller. Author:Jason Walker
Last Modified: 3/20/2013 Last Modified: 3/20/2013
#> #>
[CmdletBinding()] [CmdletBinding()]
Param( Param (
[Parameter(Mandatory=$True)] [Parameter(Mandatory=$True)]
[String]$Identity [String]$Identity
) )
@ -55,31 +48,17 @@ Function Get-LockedOutLocation
{ {
#Get all domain controllers in domain #Get all domain controllers in domain
cls
$DomainControllers = Get-ADDomainController -Filter * $DomainControllers = Get-ADDomainController -Filter *
$PDCEmulator = ( $PDCEmulator = ($DomainControllers | Where-Object {$_.OperationMasterRoles -contains "PDCEmulator"})
$DomainControllers | Where-Object
{
$_.OperationMasterRoles -contains "PDCEmulator"
}
)
Write-Verbose "Finding the domain controllers in the domain" Write-Verbose "Finding the domain controllers in the domain"
Foreach ($DC in $DomainControllers) Foreach($DC in $DomainControllers)
{ {
$DCCounter++ $DCCounter++
Write-Progress -Activity "Contacting DCs for lockout info" ` Write-Progress -Activity "Contacting DCs for lockout info" -Status "Querying $($DC.Hostname)" -PercentComplete (($DCCounter/$DomainControllers.Count) * 100)
-Status "Querying $($DC.Hostname)" `
-PercentComplete (($DCCounter/$DomainControllers.Count) * 100)
Try Try
{ {
$UserInfo = Get-ADUser -Identity $Identity ` $UserInfo = Get-ADUser -Identity $Identity -Server $DC.Hostname -Properties AccountLockoutTime,LastBadPasswordAttempt,BadPwdCount,LockedOut -ErrorAction Stop
-Server $DC.Hostname `
-Properties AccountLockoutTime,`
LastBadPasswordAttempt,`
BadPwdCount,`
LockedOut
-ErrorAction Stop
} }
Catch Catch
{ {
@ -89,59 +68,45 @@ Function Get-LockedOutLocation
If($UserInfo.LastBadPasswordAttempt) If($UserInfo.LastBadPasswordAttempt)
{ {
$LockedOutStats += New-Object -TypeName PSObject -Property @{ $LockedOutStats += New-Object -TypeName PSObject -Property @{
Name = $UserInfo.SamAccountName Name = $UserInfo.SamAccountName
SID = $UserInfo.SID.Value SID = $UserInfo.SID.Value
LockedOut = $UserInfo.LockedOut LockedOut = $UserInfo.LockedOut
BadPwdCount = $UserInfo.BadPwdCount BadPwdCount = $UserInfo.BadPwdCount
BadPasswordTime = $UserInfo.BadPasswordTime BadPasswordTime = $UserInfo.BadPasswordTime
DomainController = $DC.Hostname DomainController = $DC.Hostname
AccountLockoutTime = $UserInfo.AccountLockoutTime AccountLockoutTime = $UserInfo.AccountLockoutTime
LastBadPasswordAttempt = ` LastBadPasswordAttempt = ($UserInfo.LastBadPasswordAttempt).ToLocalTime()
($UserInfo.LastBadPasswordAttempt).ToLocalTime() }
}
}#end if }#end if
}#end foreach DCs }#end foreach DCs
$LockedOutStats | Format-Table -Property Name,` $LockedOutStats | Format-Table -Property Name,LockedOut,DomainController,BadPwdCount,AccountLockoutTime,LastBadPasswordAttempt -AutoSize
LockedOut,`
DomainController,`
BadPwdCount,`
AccountLockoutTime,`
LastBadPasswordAttempt `
-AutoSize
#Get User Info #Get User Info
Try Try
{ {
Write-Verbose "Querying event log on $($PDCEmulator.HostName)" Write-Verbose "Querying event log on $($PDCEmulator.HostName)"
$LockedOutEvents = Get-WinEvent -ComputerName $PDCEmulator.HostName` $LockedOutEvents = Get-WinEvent -ComputerName $PDCEmulator.HostName -FilterHashtable @{LogName='Security';Id=4740} -ErrorAction Stop | Sort-Object -Property TimeCreated -Descending
-FilterHashtable @{LogName='Security';Id=4740} `
-ErrorAction Stop | Sort-Object `
-Property TimeCreated
-Descending
} }
Catch Catch
{ {
Write-Warning $_ Write-Warning $_
Continue Continue
}#end catch }#end catch
$Events = Foreach($Event in $LockedOutEvents) $Events = Foreach($Event in $LockedOutEvents)
{ {
If($Event | Where {$_.Properties[2].value -match $UserInfo.SID.Value}) If($Event | Where {$_.Properties[2].value -match $UserInfo.SID.Value})
{ {
$Event | Select-Object -Property `
@( $Event | Select-Object -Property @(
@{Label = 'User'; Expression = {$_.Properties[0].Value}} @{Label = 'User'; Expression = {$_.Properties[0].Value}}
@{Label = 'DomainController'; Expression = {$_.MachineName}} @{Label = 'DomainController'; Expression = {$_.MachineName}}
@{Label = 'EventId'; Expression = {$_.Id}} @{Label = 'EventId'; Expression = {$_.Id}}
@{Label = 'LockedOutTimeStamp'; Expression = {$_.TimeCreated}} @{Label = 'LockedOutTimeStamp'; Expression = {$_.TimeCreated}}
@{Label = 'Message'; Expression = {$_.Message ` @{Label = 'Message'; Expression = {$_.Message -split "`r" | Select -First 1}}
-split "`r" | Select -First 1}} @{Label = 'LockedOutLocation'; Expression = {$_.Properties[1].Value}}
@{Label = 'LockedOutLocation'; Expression =
{
$_.Properties[1].Value
}
}
) )
}#end ifevent }#end ifevent
}#end foreach lockedout event }#end foreach lockedout event