Search Active Directory for Locked-Out Accounts

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

ADManager Plus
Active Directory, Microsoft 365, and Exchange management and reporting
ADAudit Plus
Hybrid AD, cloud, and file auditing; security; and compliance
ADSelfService Plus
Identity security with adaptive MFA, SSPR, and SSO
Exchange Reporter Plus
Reporting, auditing, and monitoring for hybrid Exchange and Skype
RecoveryManager Plus
Active Directory, Microsoft 365, and Exchange backup and recovery

How to get a list of locked-out user accounts in Active Directory

User accounts in Active Directory can get locked out either because a legitimate user locks themselves out, or because of a security issue. In either case, IT administrators need to search for locked-out accounts and take remedial action.

The following is a comparison between using Windows PowerShell and ADAudit Plus, to obtain the list of locked-out users in Active Directory:

PowerShell

Steps to obtain the list of locked out users:

Identify the domain from which you want to retrieve the report.
Identify the primary DC to retrieve the report.
Compile the script.
Execute it in Windows PowerShell
In case you want to export the report in a particular file format, you will need to customize the cmdlet as required.

Sample Windows PowerShell script

Search-ADAccount –LockedOut -UsersOnly

Copied

ADAudit Plus

To obtain the report,

Navigate to Reports -> User Management -> Account Lockout Analyzer
Select either the required 'Domain' or select 'All Domains'.
Use the 'Search' option to filter for specific user names, or domain controller, if required.
Obtain a list of all the account lockouts for a time period of your choice.
Export the report in a format of your choice: CSV, PDF, XLS, or HTML.

The following are the limitations of using PowerShell to track the source of an account lockout:

We can run this script only from the computers which have Active Directory Domain Services role.
Difficult to change date formats.
Difficult to apply different time zones on the date results.
Need to write a different code each time you want a report in a different file format.
Applying filters, like 'During business hours', 'Period', and 'Export as' will increase the LDAP query complexity.

On the other hand, ADAudit Plus will automatically scan all DCs in the domain to retrieve the list of account lockouts.

Active Directory auditing

Windows file auditing

NAS device file auditing

Windows server auditing

Workstation auditing

Entra ID auditing

All features →

Help documents

Video zone

Webinars

Product brochures

Case studies

E-books

Awards zone

Study

How tos

Best practices

How to get a list of locked-out user accounts in Active Directory

PowerShell

Steps to obtain the list of locked out users:

Sample Windows PowerShell script

ADAudit Plus

To obtain the report,

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

How to get a list of locked-out user accounts in Active Directory

PowerShell

Steps to obtain the list of locked out users:

Sample Windows PowerShell script

ADAudit Plus

To obtain the report,

Related Resources

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure