Active Directory – Blogs Created by Daag van der Meer

AD Send mail on password reset

This is based on Security Event ID 4724. When this is logged on the domain controller, Task Scheduler kicks this script. And send a mail to Admin and user. And also creates a local log file who reset the password.

# Created by Daag van der Meer on 12-10-2018
# Blog.van-daag.nl
# Powershell Send mail When account password reset is done To user and admin.
# Save this also in a Log file
 
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\reset.html" 

##################
## Log location
##################
$log= "C:\Logs\Accountreset.csv"
 
$HTML=@" 
<title>Account locked out Report</title> 
<!--mce:0--> 
"@ 

##################
## Retrieve eventlog with all value
##################

$event = Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 |
 Select TimeGenerated, ReplacementStrings |
  % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[0] 
      "Account Domain" = $_.ReplacementStrings[1] 
      "Reset by" = $_.ReplacementStrings[4] 
      Date = $_.TimeGenerated 
    } 
   } 

##################
## Retrieve eventlog For filter username
##################

$userevent= Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 | Select-Object @{n='UserName';e={$_.ReplacementStrings[0]}}
$user= $userevent -replace ".*=" -replace "}"

##################
## send mail to admin
##################


$event | ConvertTo-Html -Property "Account name","Account Domain","Reset By",Date -head $HTML -body  "<H2> User account password is reset</H2>"| 
     Out-File $Report -Append 

##################
## Mail config admin
##################

$MailBody= Get-Content $Report 
$MailSubject= "User password reset" 
$SmtpClient = New-Object system.net.mail.smtpClient 
$SmtpClient.host = "<MAIL SERVER>" 
$MailMessage = New-Object system.net.mail.mailmessage 
$MailMessage.from = "<FROM MAILADRESS>" 
$MailMessage.To.add("<MAILADRESS>") 
$MailMessage.Subject = $MailSubject 
$MailMessage.IsBodyHtml = 1 
$MailMessage.Body = $MailBody 
$SmtpClient.Send($MailMessage) 

del c:\Temp\reset.html
$event | Export-Csv $log -NoTypeInformation -Append


#############################
### Send mail to user #######
#############################

$useremail = Get-ADUser $user -Properties mail | Select-Object -ExpandProperty mail
$userfirstname1 = Get-ADUser $user -Properties GivenName | Select-Object GivenName
$userfirstname = $userfirstname1 -replace ".*=" -replace "}"
$userlastsname1 = Get-ADUser $user -Properties Surname | Select-Object Surname
$userlastsname = $userlastsname1 -replace ".*=" -replace "}"

$Pic = '<ADD LOCATION FOR PICTURE IN MAIL>'

$att1 = new-object Net.Mail.Attachment($Pic)
$att1.ContentType.MediaType = “image/png”
$att1.ContentId = “Attachment”

##################
## HTML mail setup to user
##################

$userBody = @"
<html>
    <body>
    <span lang=NL style='font-size:10.0pt;line-height:106%;color:black'>
Dear $userfirstname $userlastsname,<br>
<br>
The password for your <b>DOMAIN\$user</b> account has been reset.<br>
If you did not request this, please inform:<br>
<br>
This is an automated email.<br>
<br>
</span>
<img src="cid:Attachment">
"@

##################
## Mail config user
##################

$userSubject = "Your password is changed"
$userMessage = New-Object system.net.mail.mailmessage 
$userMessage.from = "<FROM MAILADRESS>"
$userMessage.To.add("$useremail")  
$userMessage.Subject = $userSubject  
$userMessage.IsBodyHtml = 1
$userMessage.Body = $userBody 


$userMessage.Attachments.Add($att1)


$SmtpClient.Send($userMessage)

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

# Created by Daag van der Meer on 12-10-2018

# Blog.van-daag.nl

# Powershell Send mail When account password reset is done To user and admin.

# Save this also in a Log file

##################

## Temp location for creating HTML email

##################

$Report= "c:\Temp\reset.html"

##################

## Log location

##################

$log= "C:\Logs\Accountreset.csv"

$HTML=@"

<title>Account locked out Report</title>

##################

## Retrieve eventlog with all value

##################

$event = Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 |

Select TimeGenerated, ReplacementStrings |

% {

New-Object PSObject -Property @{

"Account name" = $_.ReplacementStrings[0]

"Account Domain" = $_.ReplacementStrings[1]

"Reset by" = $_.ReplacementStrings[4]

Date = $_.TimeGenerated

}

##################

## Retrieve eventlog For filter username

##################

$userevent= Get-EventLog -LogName Security -InstanceId 4724 -Newest 1 | Select-Object @{n='UserName';e={$_.ReplacementStrings[0]}}

$user= $userevent -replace ".*=" -replace "}"

##################

## send mail to admin

##################

$event | ConvertTo-Html -Property "Account name","Account Domain","Reset By",Date -head $HTML -body "<H2> User account password is reset</H2>"|

Out-File $Report -Append

##################

## Mail config admin

##################

$MailBody= Get-Content $Report

$MailSubject= "User password reset"

$SmtpClient = New-Object system.net.mail.smtpClient

$SmtpClient.host = "<MAIL SERVER>"

$MailMessage = New-Object system.net.mail.mailmessage

$MailMessage.from = "<FROM MAILADRESS>"

$MailMessage.To.add("<MAILADRESS>")

$MailMessage.Subject = $MailSubject

$MailMessage.IsBodyHtml = 1

$MailMessage.Body = $MailBody

$SmtpClient.Send($MailMessage)

del c:\Temp\reset.html

$event | Export-Csv $log -NoTypeInformation -Append

#############################

### Send mail to user #######

#############################

$useremail = Get-ADUser $user -Properties mail | Select-Object -ExpandProperty mail

$userfirstname1 = Get-ADUser $user -Properties GivenName | Select-Object GivenName

$userfirstname = $userfirstname1 -replace ".*=" -replace "}"

$userlastsname1 = Get-ADUser $user -Properties Surname | Select-Object Surname

$userlastsname = $userlastsname1 -replace ".*=" -replace "}"

$Pic = '<ADD LOCATION FOR PICTURE IN MAIL>'

$att1 = new-object Net.Mail.Attachment($Pic)

$att1.ContentType.MediaType = “image/png”

$att1.ContentId = “Attachment”

##################

## HTML mail setup to user

##################

$userBody = @"

<html>

<body>

Dear $userfirstname $userlastsname,<br>

<br>

The password for your <b>DOMAIN\$user</b> account has been reset.<br>

If you did not request this, please inform:<br>

<br>

This is an automated email.<br>

<br>

</span>

##################

## Mail config user

##################

$userSubject = "Your password is changed"

$userMessage = New-Object system.net.mail.mailmessage

$userMessage.from = "<FROM MAILADRESS>"

$userMessage.To.add("$useremail")

$userMessage.Subject = $userSubject

$userMessage.IsBodyHtml = 1

$userMessage.Body = $userBody

$userMessage.Attachments.Add($att1)

$SmtpClient.Send($userMessage)

AD Send mail on Account Lock

At a company where I worked, there was no logging with account lock and the had plans to change the GPO that accounts will not be auto unlocked.
So I also added mailing to the admin of that specific OU (Country)

I found a script from Maxzor1908 on Technet
That was the basic. I Added a lot of extra.

# Powershell User Account locked out Maxzor1908 *16/4/2013* 
# Checked and edit by Daag van der Meer - 03-10-2018
# blog.van-daag.nl
#              Email adress needs to be filled in at the admin account.
 
##################
## Temp location for creating HTML email
##################
$Report= "c:\Temp\Lockedhtml.html" 

##################
## Log location
##################
$log= "C:\Logs\AccountLocked.csv"
 
$HTML=@" 
<title>Account locked out Report</title> 
<!--mce:0--> 
"@ 
 
$Account_Name = @{n='Account name';e={$_.ReplacementStrings[-1]}} 
$Account_domain = @{n='Account Domain';e={$_.ReplacementStrings[-2]}} 
$Caller_Computer_Name = @{n='Caller Computer Name';e={$_.ReplacementStrings[-1]}} 
 
##################
## Retrieve eventlog with all value
##################

             
$event= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 | 
   Select TimeGenerated,ReplacementStrings,"Account name","Account Domain","Caller Computer Name" | 
   % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[-7] 
      "Account Domain" = $_.ReplacementStrings[5] 
      "Caller Computer Name" = $_.ReplacementStrings[1] 
      Date = $_.TimeGenerated 
    } 
   } 
    
  $event | ConvertTo-Html -Property "Account name","Account Domain","Caller Computer Name",Date -head $HTML -body  "<H2> User is locked in the Active Directory</H2>"| 
     Out-File $Report -Append 
 

##################
## Retrieve eventlog For filter username
##################


 $user= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 | 
   Select ReplacementStrings | 
   % { 
     New-Object PSObject -Property @{ 
      "Account name" = $_.ReplacementStrings[-7] 
      } 
   } 

$userrename = $user -replace ".*=" -replace "}"
$userou = Get-ADUser $userrename -Properties DistinguishedName | Select-Object -ExpandPropert DistinguishedName

##############################
## Here is the ad Groups configured who can unlock accounts
#############################
 

if ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

elseif ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

else {$mail = "<AD GROUP>" }

$adminmail = Get-ADGroupMember $mail | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail} | %{write-output "$($_.mail)"}
$mailadmin =  $adminmail -join "," -replace ",,"

##################
## Mail config admin
##################


$MailBody= Get-Content $Report 
$MailSubject= "User Account locked out" 
$SmtpClient = New-Object system.net.mail.smtpClient 
$SmtpClient.host = "<MAIL SERVER>" 
$MailMessage = New-Object system.net.mail.mailmessage 
$MailMessage.from = "<FROM MAIL ADRESS>" 
$MailMessage.To.add("<TO MAIL ADRESS>,$mailadmin") 
$MailMessage.Subject = $MailSubject 
$MailMessage.IsBodyHtml = 1 
$MailMessage.Body = $MailBody 
$SmtpClient.Send($MailMessage) 


##################
## Remove the temp document
##################
del c:\Temp\Lockedhtml.html

##################
## Write to log about the account lock
##################

$event | Export-Csv $log -NoTypeInformation -Append

100

101

102

# Powershell User Account locked out Maxzor1908 *16/4/2013*

# Checked and edit by Daag van der Meer - 03-10-2018

# blog.van-daag.nl

# Email adress needs to be filled in at the admin account.

##################

## Temp location for creating HTML email

##################

$Report= "c:\Temp\Lockedhtml.html"

##################

## Log location

##################

$log= "C:\Logs\AccountLocked.csv"

$HTML=@"

<title>Account locked out Report</title>

$Account_Name = @{n='Account name';e={$_.ReplacementStrings[-1]}}

$Account_domain = @{n='Account Domain';e={$_.ReplacementStrings[-2]}}

$Caller_Computer_Name = @{n='Caller Computer Name';e={$_.ReplacementStrings[-1]}}

##################

## Retrieve eventlog with all value

##################

$event= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 |

Select TimeGenerated,ReplacementStrings,"Account name","Account Domain","Caller Computer Name" |

% {

New-Object PSObject -Property @{

"Account name" = $_.ReplacementStrings[-7]

"Account Domain" = $_.ReplacementStrings[5]

"Caller Computer Name" = $_.ReplacementStrings[1]

Date = $_.TimeGenerated

}

$event | ConvertTo-Html -Property "Account name","Account Domain","Caller Computer Name",Date -head $HTML -body "<H2> User is locked in the Active Directory</H2>"|

Out-File $Report -Append

##################

## Retrieve eventlog For filter username

##################

$user= Get-EventLog -LogName Security -InstanceId 4740 -Newest 1 |

Select ReplacementStrings |

% {

New-Object PSObject -Property @{

"Account name" = $_.ReplacementStrings[-7]

}

$userrename = $user -replace ".*=" -replace "}"

$userou = Get-ADUser $userrename -Properties DistinguishedName | Select-Object -ExpandPropert DistinguishedName

##############################

## Here is the ad Groups configured who can unlock accounts

#############################

if ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

elseif ($userou.Contains('OU=<OU>')) {$mail = "<AD GROUP>"}

else {$mail = "<AD GROUP>" }

$adminmail = Get-ADGroupMember $mail | select samaccountname | %{Get-ADUser $_.samaccountname -Properties mail} | %{write-output "$($_.mail)"}

$mailadmin = $adminmail -join "," -replace ",,"

##################

## Mail config admin

##################

$MailBody= Get-Content $Report

$MailSubject= "User Account locked out"

$SmtpClient = New-Object system.net.mail.smtpClient

$SmtpClient.host = "<MAIL SERVER>"

$MailMessage = New-Object system.net.mail.mailmessage

$MailMessage.from = "<FROM MAIL ADRESS>"

$MailMessage.To.add("<TO MAIL ADRESS>,$mailadmin")

$MailMessage.Subject = $MailSubject

$MailMessage.IsBodyHtml = 1

$MailMessage.Body = $MailBody

$SmtpClient.Send($MailMessage)

##################

## Remove the temp document

##################

del c:\Temp\Lockedhtml.html

##################

## Write to log about the account lock

##################

$event | Export-Csv $log -NoTypeInformation -Append

AD Change Display name

At the company were I worked we had a name change. They also use the display name in outlook to send mail. Example: Daag van der Meer [Company] So everyone see direct what the company is.

The script below built the display name with firstname lastname [Company]

# Script created by Daag van der Meer
# Blog.van-daag.nl

Import-Module ActiveDirectory

#creates a list of all users (change all between <>
$allUsers = Get-ADUser -Filter * -SearchBase 'ou=Users,ou=<OU>,DC=<DC>,DC=<DC' -Properties cn,displayName

 
# Add your company name or something else after username 
$hi = "<company>"

 

foreach ( $u in $allUsers | Where-Object { ($_.givenName) -and ($_.surName) } ) {

    $fn = $u.givenName.Trim()

    $ln = $u.surName.Trim()

   

    Write-Host $fn $ln

    Set-ADUser -Identity $u -DisplayName "$fn $ln $hi" -GivenName "$fn" -SurName "$ln"-PassThru |

        Rename-ADObject -NewName "$fn $ln $hi"

}

# Script created by Daag van der Meer

# Blog.van-daag.nl

Import-Module ActiveDirectory

#creates a list of all users (change all between <>

$allUsers = Get-ADUser -Filter * -SearchBase 'ou=Users,ou=<OU>,DC=<DC>,DC=<DC' -Properties cn,displayName

# Add your company name or something else after username

$hi = "<company>"

foreach ( $u in $allUsers | Where-Object { ($_.givenName) -and ($_.surName) } ) {

$fn = $u.givenName.Trim()

$ln = $u.surName.Trim()

Write-Host $fn $ln

Set-ADUser -Identity $u -DisplayName "$fn $ln $hi" -GivenName "$fn" -SurName "$ln"-PassThru |

Rename-ADObject -NewName "$fn $ln $hi"

}