I attached this script to the event 4740 to notify users about issues with their acounts<\/p>\n
Script:<\/p>\n
############################################
\n# Alert script for the security event 4740 #
\n# Just attach it to the event\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #
\n# \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 2015\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #
\n############################################<\/p>\n# Get the latest event
\n$AccountLockOutEvent = Get-EventLog -LogName “Security” -InstanceID 4740 -Newest 1<\/p>\n# Extract the data and assign variables
\n$AccountLockOutEventTime = $AccountLockOutEvent.TimeGenerated
\n$AccountLockOutEventMessage = $AccountLockOutEvent.Message
\n$Account = $AccountLockOutEvent.ReplacementStrings[0]
\n$Computer = $AccountLockOutEvent.ReplacementStrings[1]
\n$AccountMail = $Account + “@company.com”<\/p>\n# Generate custom info-messages
\n$MM = switch ($Computer)
\n{
\nmail1 {“to the mail-server”}
\nmail1 {“to the mail-server”}
\nDC1 {“to the domain controller”}
\nDC2 {“to the domain controller”}
\nDC3 {“to the domain controller”}
\nIIS {“to the web-services”}
\ndefault {“to our servers or services”}
\n}<\/p>\n# Create the e-mail message
\n$messageParameters = @{
\nSubject = “Account Locked Out: $Account”
\nBody = “<b><font color=red>Account $Account was locked out on $AccountLockOutEventTime due 10 incorrect attempts $MM.<\/br><br><font color=blue>Please, check the saved passwords\u00a0 in your system and browser: <a href=http:\/\/wiki.complany.com.ua\/cache.html>http:\/\/wiki.company.com.ua\/cache.html<\/a><\/br><br>Event Details:<\/br><br><font color=green>$AccountLockOutEventMessage”
\nFrom = “pguard@company.com”
\nTo = “adm@company.com”, $AccountMail
\nSmtpServer = “192.168.100.220”
\n}<\/p>\n# Send the e-mail
\nSend-MailMessage @messageParameters -BodyAsHtml<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"I attached this script to the event 4740 to notify users about issues with their acounts Script: ############################################ # Alert script for the security event 4740 # # Just attach it to the event\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # # \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 2015\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # ############################################ # Get the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,12],"tags":[],"class_list":["post-708","post","type-post","status-publish","format-standard","hentry","category-novosti","category-windows"],"_links":{"self":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/708","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=708"}],"version-history":[{"count":3,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/708\/revisions"}],"predecessor-version":[{"id":711,"href":"https:\/\/dety.net.ua\/index.php?rest_route=\/wp\/v2\/posts\/708\/revisions\/711"}],"wp:attachment":[{"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=708"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=708"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dety.net.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=708"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}