If you have enabled that a user get lock out in Active Directory, if the user type the password wrong X times.
Then you might have experienced, that yours admin account get locked out multiple times, just after you have change the password for the admin account.
It could be that you have left a session on a server in you Active Directory logged on, and that session now trying to authenticated it self, by using you old password.
You can run this script, to check all servers in Active Directory, to see where there are user session on it.
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 |
function Get-LoggedOnUsers ($server) { if($server -eq $null){ $server = "localhost" } $users = @() # Query using quser, 2>$null to hide "No users exists...", then skip to the next server $quser = quser /server:$server 2>$null if(!($quser)){ Continue } #Remove column headers $quser = $quser[1..$($quser.Count)] foreach($user in $quser){ $usersObj = [PSCustomObject]@{Server=$null;Username=$null;SessionName=$null;SessionId=$Null;SessionState=$null;LogonTime=$null;IdleTime=$null} $quserData = $user -split "\s+" #We have to splice the array if the session is disconnected (as the SESSIONNAME column quserData[2] is empty) if(($user | select-string "Disc") -ne $null){ #User is disconnected $quserData = ($quserData[0..1],"null",$quserData[2..($quserData.Length -1)]) -split "\s+" } # Server $usersObj.Server = $server # Username $usersObj.Username = $quserData[1] # SessionName $usersObj.SessionName = $quserData[2] # SessionID $usersObj.SessionID = $quserData[3] # SessionState $usersObj.SessionState = $quserData[4] # IdleTime $quserData[5] = $quserData[5] -replace "\+",":" -replace "\.","0:0" -replace "Disc","0:0" if($quserData[5] -like "*:*"){ $usersObj.IdleTime = [timespan]"$($quserData[5])" }elseif($quserData[5] -eq "." -or $quserData[5] -eq "none"){ $usersObj.idleTime = [timespan]"0:0" }else{ $usersObj.IdleTime = [timespan]"0:$($quserData[5])" } # LogonTime $usersObj.LogonTime = (Get-Date "$($quserData[6]) $($quserData[7]) $($quserData[8] )") $users += $usersObj } return $users } $strCategory = "computer" $strOperatingSystem = "Windows*Server*" $objDomain = New-Object System.DirectoryServices.DirectoryEntry $objSearcher = New-Object System.DirectoryServices.DirectorySearcher $objSearcher.SearchRoot = $objDomain $objSearcher.Filter = ("OperatingSystem=$strOperatingSystem") $colProplist = "name" foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i)} $colResults = $objSearcher.FindAll() foreach ($objResult in $colResults) { If ($Err -ne $null) { Remove-Variable Err } $objComputer = $objResult.Properties; $ServerName = $objComputer.name $isalive = Test-Connection -BufferSize 32 -Count 1 -ComputerName $servername -Quiet if($isalive -eq $True) { $wmi = Get-WmiObject -class "Win32_Process" -namespace "root\cimv2" -computername $ServerName -EV Err -EA SilentlyContinue if ($Err) { } Else { Get-LoggedOnUsers $ServerName | ft -autosize } } } |
You can change this last command:
Get-LoggedOnUsers $ServerName | ft -autosize
to
Get-LoggedOnUsers $ServerName | ? { $_.Username -eq ‘kda’ } | ft -autosize
to only see where KDA is loggedon