Monitor Account Lockouts Active Directory

One of the time wasters of a system administrator can be chasing down account lockouts and why they happen.  Many administrators have felt the pain of parsing through logs, etc to try and figure out what is going on with account lockouts if they are unusually high for a particular account.  There are many solutions out there for account lockout monitoring many of which can be done fairly eloquently with powershell, however, if you have a mix of older DCs as well on which you don’t really have the ability to enable powershell without some pain, your options start to be minimized.

I wanted to do a quick spotlight on a tool that I am sure many have stumbled across in times past and may even be using called Account Lockout Examiner made by Netwrix.  The great thing about this tool is that it is completely free.  I am skeptical when I see the “free” designation on certain tools as there is usually a catch to the free designation.  However, after using this tool and installing in a lab and test production environment, I was pleasantly surprised that it doesn’t seem to be limited in any way.

I won’t bore anyone with the install of this product as it is a simple and straightforward install.  Once installed, there are very straightforward settings to get things setup and operating correctly.  Basically to get up and running you:

• Add your domain including domain controller (PDC) or all domain controllers
• Setup your email alerts by populating email address and SMTP server address

Below are screenshots of the settings found within the program once installed:

That is it!  Aside from the settings above that make connections to the domain controller(s) and setup alerting, the interface itself also shows by default accounts that are currently locked out or that have been locked out.  You can highlight an account and click the Examine button to see further details of the lockout and also from the interface you can reset passwords or unlock accounts, which in my experience is fantastic if you are dealing with multiple domains.  If you have the domains added you can unlock accounts all from one interface.

Final Thoughts

We are all looking for tools and utilities to make our lives easier as administrators and chasing down password lockouts is the last thing we have time for with other duties as assigned.  Microsoft’s account lockout tools are a great help to finding locked out accounts and reasons for lockouts, however, the Netwrix Account Lockout Examiner takes all the leg work out of the process as it provides truly proactive account lockout alerting.