Eng. Alessandro Mazzanti: Scripting - How to unlock an account automatically with .vbs and task scheduler

If you have lockout problems on a single AD account and, temporary, you want to unlock it (from security purpose it is not an excellent choice) you can schedule a task that execute this .vbs (that can be enhanced to check if user is really lockout and write a log file too)

Set objUser = GetObject _
    ("LDAP://cn=MyerKen,ou=Management,dc=NA,dc=fabrikam,dc=com")

objUser.IsAccountLocked = False
objUser.SetInfo

Here is a script where take more user information to be merged with precedent script:

On Error Resume Next

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery _
    ("Select * from Win32_UserAccount Where LocalAccount = True")

For Each objItem in colItems
    Wscript.Echo "Account Type: " & objItem.AccountType
    Wscript.Echo "Caption: " & objItem.Caption
    Wscript.Echo "Description: " & objItem.Description
    Wscript.Echo "Disabled: " & objItem.Disabled
    Wscript.Echo "Domain: " & objItem.Domain
    Wscript.Echo "Full Name: " & objItem.FullName
    Wscript.Echo "Local Account: " & objItem.LocalAccount
    Wscript.Echo "Lockout: " & objItem.Lockout
    Wscript.Echo "Name: " & objItem.Name
    Wscript.Echo "Password Changeable: " & objItem.PasswordChangeable
    Wscript.Echo "Password Expires: " & objItem.PasswordExpires
    Wscript.Echo "Password Required: " & objItem.PasswordRequired
    Wscript.Echo "SID: " & objItem.SID
    Wscript.Echo "SID Type: " & objItem.SIDType
    Wscript.Echo "Status: " & objItem.Status
    Wscript.Echo
Next

More information on lockout AD events and monitoring tool can be found searching inside blog about this article:

AD - Lockout events on domain controller

Pagine

Scripting - How to unlock an account automatically with .vbs and task scheduler