SERVER-023 · Script

Find Locked Directory Accounts

Lists locked-out directory accounts and, optionally, which computer caused each lockout.

Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing

What it does

Finds user accounts that are locked out right now, with lockout time, bad password count and last bad password time. With -IncludeSource, it also reads lockout events (ID 4740) from the domain controller that holds the PDC emulator role, which records every lockout in the domain, and shows the computer the bad passwords came from. That is often a phone, an old mapped drive, or a saved credential on another PC. Read-only; changes nothing. To unlock accounts, use SERVER-032.

Requirements

Windows PowerShell 5.1 and the ActiveDirectory module (RSAT). For -IncludeSource: membership in Event Log Readers (or admin) on the PDC emulator, and remote event log access.

How to run it

Run as: a service account with the directory rights the script lists, or SYSTEM on a domain controller or the server being checked
Run from: a domain-joined management server or admin workstation with the RSAT tools, as a scheduled task or from your management tool
Script type: PowerShell 5.1, 64-bit
User interaction: none; the script never prompts
Timeout: 30 minutes for large directories or many servers

Settings

Name	What it does	Options	Default
SearchBase	OU (distinguished name) to check. If empty, the whole domain.
IncludeSource	Read lockout events from the PDC emulator to find where each lockout came from.		False
Hours	With -IncludeSource, how many hours of events to read. Default: 24.		24
AlertOn	Locked (default) exits 1 when any account is locked out. Never always exits 0.	Locked, Never	Locked
Server	Optional domain controller to read from.

Exit codes

0 = No accounts locked out (or AlertOn is Never)
1 = One or more accounts locked out
2 = Script error (see log)

Testing steps

Run it on one test OU, test account or test server and check the output and log.
Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log

Version	Date	Changes
1.0.0	November 2026	First release.