Download: version 1.01         Change Log

Find account lockout location, date and time of event ID 4740. Query PDC or all domain controllers. Examples:

.\Lockouts.ps1 -User user123 -LocalHost
.\Lockouts.ps1 user123 -Server dcprod01
.\Lockouts.ps1 user123 -PDC -Credential domain\user
.\Lockouts.ps1 user123 -Domain prod.net -Credential domain\user:password

Get lockout events from PDC for all users. Export the result in text file:

.\Lockouts.ps1 -Domain dev.net -Export Results.txt