Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Active Directory up to 2008 network (our servers are a mix of 2008, 2003...)

I'm looking for a quick way to query AD to find out what users are locked out, preferably from a batch or script file, to monitor for possible issues with either user accounts being attacked by an automated attack or just anomalies in the network.

I've Googled and my Google-fu has failed; I found a query off Microsoft's own knowledgebase that cites a string to use on Server 2003 with the management snap-in's saved queries (http://support.microsoft.com/kb/555131) but when I entered it, the query returned 400 users that a spot-check showed did NOT have a checkmark in the "Account is locked out" box under "account." In fact, I don't see anything wrong with their accounts.

Is there a simple utility (wisesoft bulkadusers apparently uses this method behind the scenes, since it's results were also wrong) that will give a count of users and possibly their user object names? Script? Something?

share|improve this question
    
Have a look at my answer to this question: serverfault.com/questions/65265/… –  squillman Feb 4 '11 at 15:06
    
Unfortunately dsquery user -disabled is only for disabled accounts, not locked-out accounts. I don't see an option for locked-out. –  mfinni Feb 4 '11 at 15:15
add comment

4 Answers

up vote 3 down vote accepted

You can use PowerShell and Quest tools.

You can just query all the AD user objects like this:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"}

If you go this route, you could create ps1 files that are scheduled to run and you can export to these to a csv or even to a website - by using ConvertTo-Html then exporting it to a html file. For example:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | Export-Csv c:\lockedoutusers.csv

or html:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | CovertTo-Html > c:\lockedoutusers.html

Or if you wanted you could just throw it up on a gridview for an interactive view:

Get-QADUser -SizeLimit 0 | Where {$_.AccountIsLockedOut -eq "true"} | Out-GridView

share|improve this answer
    
Looking at the site, are the tools something that require a purchased tool first to use? They're all marked "compatible with only ARS 6.5.0" –  Bart Silverstrim Feb 4 '11 at 15:43
    
the AD tools are definitely free, work on any standard win XP\7 powershell environment. –  Jordan W. Feb 4 '11 at 16:12
    
@michaelburns-you have -sizelimkit in your examples, but it kept giving me an error until I used sizelimit...now I'm wondering what it's doing...(/watches names scrolling by as it's "processing"...) –  Bart Silverstrim Feb 4 '11 at 17:16
    
It seems to work! I locked out an account to test it and it found it and listed just that account...Yay! Not quite automated or easy to keep checking, but it seems to work for manual checks. –  Bart Silverstrim Feb 4 '11 at 17:59
    
You can automate it, save the command with a ps1 ext. and just add it to scheduler and then have it run when you want. Check it when you want or add it to a website. –  Michael Burns Feb 5 '11 at 3:48
add comment

I have had great success using the following "Saved Query" from within the AD snap-in.

(&(&(&(&(&(&(&(objectCategory=person)(objectClass=user)(lockoutTime:1.2.840.113556.1.4.804:=4294967295))))))))

To add this query, open up the AD MMC, Right click on "Saved Queries", select "New", "Query", then click "Define Query", under the drop-down select "Custom Search" and then "Advanced". Copy and paste the above query. You should now be able to unlock the locked out uses right from the query you just created.

You can find this and more from this technet wikipage.

share|improve this answer
add comment

I highly recommend Unlock by Joeware.

http://www.joeware.net/freetools/tools/unlock/index.htm

This command will show locked accounts:

unlock . * -view

And by removing the -view option you can also unlock them (all of them or one user at a time). Joe's tools are super reliable for me and are also very fast.

share|improve this answer
    
gotta love those joeware tools! –  Jordan W. Feb 10 '11 at 22:55
add comment

You can also do this without 3rd party tool using the Active Directory module, as of PowerShell v2 and if you're on a 2008 domain:

get-aduser -filter * -properties * | where {$_.lockedout} | ft name,lockedout

then of course you can add Michael B's export pipes to this as well.

share|improve this answer
    
such a fan of the native commands! –  Tim Alexander Oct 4 '11 at 15:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.