Skip to content

Instantly share code, notes, and snippets.

@justengland
Last active December 3, 2018 16:12
Show Gist options
  • Save justengland/c5f28b74d63caa719aa582fac7bcf19e to your computer and use it in GitHub Desktop.
Save justengland/c5f28b74d63caa719aa582fac7bcf19e to your computer and use it in GitHub Desktop.
Get user failed logins
$userName = Read-Host "Enter Name of user or <CR> for complete list"
$DomainControllers = Get-ADDomainController -Filter *
$PDCEmulator = ($DomainControllers | Where-Object {$_.OperationMasterRoles -contains "PDCEmulator"})
foreach($pdc in $PDCEmulator){
$pdcName = $pdc.HostName #[System.DirectoryServices.ActiveDirectory.Domain]::GetDomain((New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', "time-inc-corp"))).PdcRoleOwner.name
write-host "Checking PDCEmulator: $pdcName"
Get-WinEvent -ComputerName $pdcName -FilterHashtable @{LogName='Security';Id=4740;StartTime=(Get-Date).AddDays(-1)} | Where-Object {$_.Properties[0].Value -like "*$userName*"} | Select-Object -Property TimeCreated, @{Label='UserName';Expression={$_.Properties[0].Value}},@{Label='ClientName';Expression={$_.Properties[1].Value}} | Ft -autosize
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment