something exciting

Some information about the exciting thing

Table of contents generated with markdown-toc


    Get-LockedOutUser.ps1 returns a list of users who were locked out in Active Directory.

    Get-LockedOutUser.ps1 is an advanced script that returns a list of users who were locked out in Active Directory
by querying the event logs on the PDC emulation in the domain.

    The userid of the specific user you are looking for lockouts for. The default is all locked out users.

    The datetime to start searching from. The default is all datetimes that exist in the event logs.


    Get-LockedOutUser.ps1 -UserName 'mike'

    Get-LockedOutUser.ps1 -StartTime (Get-Date).AddDays(-1)

    Get-LockedOutUser.ps1 -UserName 'miker' -StartTime (Get-Date).AddDays(-1)

param (
    $DomainName = $env:DOMAIN,

    $UserName = "*",

    $StartTime = (Get-Date).AddDays(-3)

Invoke-Command -ComputerName (

            New-Object System.DirectoryServices.ActiveDirectory.DirectoryContext('Domain', $DomainName))

) {
    Get-WinEvent -FilterHashtable @{LogName = 'Security'; Id = 4740; StartTime = $Using:StartTime } |
    Where-Object { $_.Properties[0].Value -like "$Using:UserName" } |
    Select-Object -Property TimeCreated,
    @{Label = 'UserName'; Expression = { $_.Properties[0].Value } },
    @{Label = 'ClientName'; Expression = { $_.Properties[1].Value } }
} -Credential (Get-Credential) | Select-Object -Property TimeCreated, 'UserName', 'ClientName'

Back to Top


Please feel free to copy parts of the script or if you would like to download the entire script, simple click the download button. You can download the complete repository in a zip file by clicking the Download link in the menu bar on the left hand side of the page.

Report Issues

You can report an issue or contribute to this site on GitHub. Simply click the button below and add any relevant notes. I will attempt to respond to all issues as soon as possible.


Back to Top