EventViewer + Powershell + Event 4740

20/05/2015 admin News, Windows

I attached this script to the event 4740 to notify users about issues with their acounts

Script:

############################################
# Alert script for the security event 4740 #
# Just attach it to the event              #
#                           2015                    #
############################################

# Get the latest event
$AccountLockOutEvent = Get-EventLog -LogName “Security” -InstanceID 4740 -Newest 1

# Extract the data and assign variables
$AccountLockOutEventTime = $AccountLockOutEvent.TimeGenerated
$AccountLockOutEventMessage = $AccountLockOutEvent.Message
$Account = $AccountLockOutEvent.ReplacementStrings[0]
$Computer = $AccountLockOutEvent.ReplacementStrings[1]
$AccountMail = $Account + “@company.com”

# Generate custom info-messages
$MM = switch ($Computer)
{
mail1 {“to the mail-server”}
mail1 {“to the mail-server”}
DC1 {“to the domain controller”}
DC2 {“to the domain controller”}
DC3 {“to the domain controller”}
IIS {“to the web-services”}
default {“to our servers or services”}
}

# Create the e-mail message
$messageParameters = @{
Subject = “Account Locked Out: $Account”
Body = “<b><font color=red>Account $Account was locked out on $AccountLockOutEventTime due 10 incorrect attempts $MM.</br><br><font color=blue>Please, check the saved passwords  in your system and browser: <a href=http://wiki.complany.com.ua/cache.html>http://wiki.company.com.ua/cache.html</a></br><br>Event Details:</br><br><font color=green>$AccountLockOutEventMessage”
From = “pguard@company.com”
To = “adm@company.com”, $AccountMail
SmtpServer = “192.168.100.220”
}

# Send the e-mail
Send-MailMessage @messageParameters -BodyAsHtml

Exchange 2010 + Modifying a banner for a receive connector Exchange 2010 + SMTP + TELNET + AUTH + TLS