Account lockout : Script to identify the caller's computer name

 

Use this script to identify the caller's computer name


#################

$filter = @{

logname='security'

id=4740

starttime=(get-date).adddays(-7)

}

$filter.add('data','Accountname')

get-winevent -computername DCservername -filterhashtable $filter|

select-object -property timecreated,

@{label='username';expression={$_.properties[0].value}},

@{label='computername';expression={$_.properties[1].value}}


##########################3

Comments

Post a Comment

Popular posts from this blog

User Account not shwoing in Azure Metaverse - Azure Sync Issues

  Issue : One user was not syncing to Azure AD from AD.   Outcome : Found that the user had been joined in the MV to another user and had to have their immutableID corrected to get the AD user matched back to their AAD object.   Troubleshooting: User had previously been synced to AAD, so the matching AAD object still existed in AAD, but was no longer connected to the AD object for that user. The AAD object for this user had become orphaned. Sync Server Manager Metaverse search showed that users's account had become synced with another user's account and the affected user's immutableID (msDS-ConsinstencyGuid) had been changed in AD to match the wrong AAD user. In order to separate the user's AD object from the incorrect user in AAD, we first pulled the user out of their syncing OU, ran a sync, and then put them back into their original OU and ran another sync; this was to un-sync the user from the incorrect user ...
Read more

Could not communicate with the VM agent for snapshot status.

  A Backup failure alert has been activated Description Could not communicate with the VM agent for snapshot status. Steps to resolve the issues : 1. first disable the backup of machine which has issues. 2. then flow the below steps. In Azure VM --> C:\Packages\Plugins\Microsoft.Azure.RecoveryServices.VMSnapshot found that required metadata and other files were removed. Steps Performed to resolve the issue: Rename the Folder "Microsoft.Azure.RecoveryServices.VMSnapshot" available in C:\Packages\Plugins Copy the "Microsoft.Azure.RecoveryServices.VMSnapshot" folder from working machine Take Registry backup 4.Run registry key command one by one REG ADD "HKLM\SOFTWARE\Microsoft\BcdrAgent" /v IsProviderInstalled /t REG_SZ /d False /f REG ADD "HKLM\SOFTWARE\Microsoft\BcdrAgentPersistentKeys" /v IsCommonProviderInstalled /t REG_SZ /d False /f Restart Windows Azure guest ag...
Read more

Hidden or corrupted Outlook inbox Rule

Image
  Clearing Hidden or corrupted Outlook inbox Rule 1.   Overview This document is used as a guideline to delete corrupted, hidden inbox rules from a mailbox using MFCMAPI. 2.   Procedure 1.      Export all rules from your Outlook so that you may import them back after deleting all rules via MFCMAPI.   On your Outlook client, go to “File”> “ManageRules & Alerts”.     2.       Under E-mail Rules > go to “Options” > Export Rules > “Ok”.   3.       Download the latest version of MFCMAPI from the link below   (Please make sure you download the correct release for your Outlook client e.g. 32bit or 64bit version).        https://mfcmapi.codeplex.com/ 4.       Start MFCMAPI.EXE as Administrator.     5.       Go to “Tools” > “Options”.             6. ...
Read more