Mike F Robbins

A few weeks ago a user contacted me and stated they were constantly being locked out throughout the day. This could have been caused by a number of things from someone else trying to log in as them to being logged in somewhere else, changing their password and the session with the old password still being active. I ran a search of the security event log on the domain controllers and found the name of the machine that the user was being locked out from. The event ID for lockout events is 4740 for Vista / 2008 and higher and 644 for 2000 / XP / 2003. Here’s the PowerShell script I used to find the lockout events:

$logName = "security"
$pcName = "dc01", "dc02", "dc03"
$eventID = "4740"
Get-EventLog -LogName $logName -ComputerName $pcName | where {$_.eventID -eq $eventID} `
| fl -Property timegenerated, replacementstrings, message

Based on these results, the user is being locked out from a machine named “PC01″:

The problem was that the user recently changed their password and had some out of date credentials saved in the Windows 7 Credential Manager:

This cmdlet will search Active Directory and list all of the accounts that are locked out:

Search-ADAccount -LockedOut

Here’s the results of that command:

You can use the following PowerShell command to unlock the Active Directory account:

$name = mike
Unlock-ADAccount $name

µ

This week, I was asked if I could export a list of users who were members of a specific group in Active Directory. My Question: What’s this list for? Answer: We’re working on a project that requires us to create a new security group in Active Directory and we’re going to add all the users on the list to the new group. I determined that this new group really was necessary. My response: I can do even better than providing you guys with a list. I can create the new AD group, output a list of users, and import them into the new group.

I had previously created a couple of PowerShell scripts that would help me get started. One of them created an AD group and the other added a single user to an AD group. I combined my existing scripts and nested the add user to group portion in a for each loop:

'Define variables'
$NewGrpName = "NewADGroup"
$GrpScope = "Global"
$Description = "New AD Group"
$GrpCat = "Security"
$Path = "OU=security,OU=groups,OU=test,DC=mikefrobbins,DC=com"
$ExistingGrpName = "ExistingADGroup"
$Domain = "mikefrobbins.com"

'Create a new AD group using the variables as parameters'
New-ADGroup -Name $NewGrpName  -GroupScope $GrpScope -Description $Description `
-GroupCategory $GrpCat -Path $Path

'Obtain a list of users from an existing AD Group and store them in a variable'
$UserNames = Get-ADGroupMember $ExistingGrpName | Get-ADUser | Select-Object `
-ExpandProperty SamAccountName

'Add each user to the newly created AD group'
ForEach ($UserName in $UserNames) {
$User = [ADSI]("WinNT://$Domain/$UserName")
$Grp = [ADSI]("WinNT://$Domain/$NewGrpName")
$Grp.PSBase.Invoke("Add",$User.PSBase.Path)
}

'Output a list of users that are now members of the new group'
Get-ADGroupMember $NewGrpName | Get-ADUser | Select-Object Name

PowerShell to the Rescue!

Here’s an updated script based on Jeffery Hicks comments. You’ve gotta love the PowerShell community.

$newGrpName = "NewADGroup"
$grpScope = "Global"
$description = "New AD Group"
$grpCat = "Security"
$path = "OU=security,OU=groups,OU=test,DC=mikefrobbins,DC=com"
$existingGrpName = "ExistingADGroup"

New-ADGroup -name $newGrpName -GroupScope $grpScope -Description $description -GroupCategory `
$grpCat -Path $path -PassThru  | Add-ADGroupMember -Members (Get-ADGroupMember $existingGrpName) `
-PassThru | Get-ADGroupMember | Select Name

µ