Powershell script for finding user lockout source

User Lockout Source

## Define the username that’s locked out
$Username = Read-Host "Please enter username: "

## Find the domain controller PDCe role
$Pdce = (Get-AdDomain).PDCEmulator

# Check if user locked out
$LocketOutStatus = Get-ADUser -Properties LockedOut -Identity $Username | select LockedOut

if ($LocketOutStatus.LockedOut -eq 'True'){

## Build the parameters to pass to Get-WinEvent
$GweParams = @{
     ‘Computername’ = $Pdce
     ‘LogName’ = ‘Security’
     ‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]"
}

## Query the security event log
$Events = Get-WinEvent @GweParams -Credential (Get-Credential)
Write-Host -ForegroundColor Green ($Events | foreach {$_.Properties[1].value + ' ' + $_.TimeCreated})

}
else{
Write-Host "User" $Username "not locked" -ForegroundColor Green
}