Is there a way to generate a report on "what" is locking out a user's account?

Question

We used to run AD Audit and it would provide additional details on what was locking a user's account (workstation name, application, etc...). Is there are way with Adaxes to generate a report with additional information on what is locking an account? Or a way to pull historical data on locked accounts?

Answer 1

Hello,

You can use the built-in Locked out users report to check currently locked users and their lock out time. By default, the report is located in container Reports\All Reports\Users\Account Status. Unfortunately, there is no possibility to obtain additional information or view pull historical data as accounts are being locked on Active Directory side and the operation does not go through Adaxes.

Comments

Old thread, but incase someone else is looking for this, we used a custom command in Adaxes containing a script that pulled info from the primary domain controller in the Security eventlog from ID's 4740 and 4625 that could contain some info regarding what device etc the user account was locked from.

---

Would you mind sharing the command and script you setup to pull this info?