How to generate and export users account lockout history report

Steps to obtain users account lockout history using PowerShell:

• Identify the domain from which you want to retrieve the report.
• Identify the LDAP attributes you need to fetch the report.
• Identify the primary DC to retrieve the report.
• Compile the script.
• Execute it in Windows PowerShell.
• The report will be exported in the given format.
• To obtain the report in a different format, modify the script accordingly to the needs of the user.

Sample Windows PowerShell script

$ErrorActionPreference = "SilentlyContinue"
Clear-Host
$User = Read-Host -Prompt "Please enter a user name"
#Locate the PDC
$PDC = (Get-ADDomainController -Discover -Service PrimaryDC).Name
#Locate all DCs
$DCs = (Get-ADDomainController -Filter *).Name #| Select-Object name
foreach ($DC in $DCs) {
Write-Host -ForegroundColor Green "Checking events on $dc for User: $user"
if ($DC -eq $PDC) {
    Write-Host -ForegroundColor Green "$DC is the PDC"
    }
Get-WinEvent -ComputerName $DC -Logname Security -FilterXPath "*[System[EventID=4740 or EventID=4625 or EventID=4770 or EventID=4771 and TimeCreated[timediff(@SystemTime) <= 3600000]] and EventData[Data[@Name='TargetUserName']='$User']]" | Select-Object TimeCreated,@{Name='User Name';Expression={$_.Properties[0].Value}},@{Name='Source Host';Expression={$_.Properties[1].Value}} -ErrorAction SilentlyContinue
}

To obtain the report,

• Login to ADAudit Plus web console as an administrator.
• Navigate to the Reports tab and from the User Management section in the left pane, select Account Lockout Analyzer report.
• Select the domain and click Generate .
• Select Export As to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).

Screenshot