Check if AD account is locked

fbotte · April 18, 2024, 11:37am

Hi folks,

what is the easiest way to check with CheckMK if a computer or user account has been disabled/locked in AD?

Thanks for your help

Frank

aeckstein · April 18, 2024, 11:58am

Hi Frank,

i´v written a small powershell local script to check for locked accounts :

github.com

chexma/checkmk_plugins/blob/master/local-scripts/check_locked_ad_accounts.ps1



$allowList = @("aeckstein", "user2", "user3")
$UserSearchBase = "" # "CN=Users,DC=home,DC=intra" 
$warn = 2
$crit = 5

####

# Import the Active Directory module
Import-Module ActiveDirectory


if ($UserSearchBase) {
    $lockedUsers = Get-ADUser -Filter * -Properties LockedOut -SearchBase $UserSearchBase | Where-Object {$_.Enabled -like "*true*" } | Select-Object -Property SamAccountName
} else {
    $lockedUsers = Get-ADUser -Filter * -Properties LockedOut | Where-Object {$_.Enabled -like "*true*" } | Select-Object -Property SamAccountName
}

# Initialize an empty string to store locked account information

This file has been truncated. show original

Just copy that script in the local directory on the domain controller.

fbotte · April 19, 2024, 6:04am

Hi Andre,

thanks for the script. I have to adapt it a little because i want to check for specific accounts but that should be doable even for a non windows guy.

cheers
Frank