Import-Module ActiveDirectory
Get-ADDomainController -fi * | select -exp hostname | % {
$GweParams = @{
‘Computername’ = $_
‘LogName’ = ‘Security’
‘FilterXPath’ = "*[System[EventID=4740]]"
}
$Events = Get-WinEvent @GweParams
$properties = @(
'TimeCreated',
@{n='Account Name';e={$_.Properties[0].Value}},
@{n='Computer';e={$_.Properties[1].Value}}
)
$Events | Select $properties
<#
TimeCreated Account Name Computer
----------- ------------ --------
03.09.2019 16:49:40 User1 WSKOMP1
02.09.2019 19:04:25 User2 WSKOMP3
02.09.2019 9:23:53 user2 WSKOMP3
#>
} | Out-File -FilePath .\report.txt
$From = "server@contoso.ru"
$To = "admin@contoso.ru"
$Subject = "AD account is locked!"
$Body = "see REPORT in attachments"
$smtpServer = "mail.contoso.ru"
$credentials = new-object Management.Automation.PSCredential "server@contoso.ru", ("mypassword" | ConvertTo-SecureString -AsPlainText -Force)
Send-MailMessage -From $From -To $To -Attachments .\report.txt -Body $Body $Subject -SmtpServer $smtpServer -Credential $credentials -Verbose -UseSsl