Troubleshooting account lockout issue

I had a problem when an Active Directory user account got locked out all the time.

I tried the following tools:
Account Lockout and Management Tools
NetWrix Account Lockout Examiner

I found out that when I unlocked the user account the bad password attempts started again and after 20 retries the account got locked out. I guessed that there must be a script or task some where on the network that used the user account and after a password change this caused the problem.

In LockoutStatus.exe (Account Lockout and Management Tools) I could see from what domain controller the lock originated from. I logged on to the domain controller and checked the security logs in the event viewer. I found the event ID 4740, that explained that user account was locked out and I also found out the caller computer name.

After a quick check on the caller computer I located the problem and solved it by adding the new password for the account.

Restore a deleted Active Directory object with PowerShell

This requires that you have enabled the enable Active Directory Recycle Bin before you deleted the object.

Run Windows PowerShell as Administrator.

Start by loading the Active Directory module for Windows PowerShell:
Import-Module ActiveDirectory

List all deleted users (for some reason computer objects also are included when you use objectclass -eq “user):
get-adobject -filter ‘objectclass -eq “user” -AND IsDeleted -eq $True’ -IncludeDeletedObjects -properties IsDeleted,LastKnownParent | Format-List Name,IsDeleted,LastKnownParent,DistinguishedName

List all deleted groups:
get-adobject -filter ‘objectclass -eq “group” -AND IsDeleted -eq $True’ -IncludeDeletedObjects -properties IsDeleted,LastKnownParent | Format-List Name,IsDeleted,LastKnownParent,DistinguishedName

List all deleted computers:
get-adobject -filter ‘objectclass -eq “group” -AND IsDeleted -eq $True’ -IncludeDeletedObjects -properties IsDeleted,LastKnownParent | Format-List Name,IsDeleted,LastKnownParent,DistinguishedName

List all deleted objects:
get-adobject -filter ‘IsDeleted -eq $True’ -IncludeDeletedObjects -properties IsDeleted,LastKnownParent | Format-List Name,IsDeleted,LastKnownParent,DistinguishedName

If you want the output in a text file:
1. Create a script file named list_deleted_users.ps1 and save it to C:\Script\.
2. Use the follwong code in the script:
Import-Module ActiveDirectory
get-adobject -filter ‘objectclass -eq “user” -AND IsDeleted -eq $True’ -IncludeDeletedObjects -properties IsDeleted,LastKnownParent | Format-List Name,IsDeleted,LastKnownParent,DistinguishedName
3. Save the script file.
4. In PowerShell navigate to C:\Script and run the following command:
.\list_deleted_users.ps1 > output.txt
5. You will now have the output from the script in C:\Script\output.txt.

To restore an object named Daniel Svensson:
get-adobject -filter ‘name -like “Daniel Svensson*”‘ -IncludeDeletedObjects | Restore-ADObject

To test the restore you can use –whatif.
get-adobject -filter ‘name -like “Daniel Svensson*”‘ -IncludeDeletedObjects | Restore-ADObject –whatif