Mike Swanson
fa15b03180
Synced files: - Quote wizard frontend (all components, hooks, types, config) - API updates (config, models, routers, schemas, services) - Client work (bg-builders, gurushow) - Scripts (BGB Lesley termination, CIPP, Datto, migration) - Temp files (Bardach contacts, VWP investigation, misc) - Credentials and session logs - Email service, PHP API, session logs Machine: ACG-M-L5090 Timestamp: 2026-03-10 19:11:00 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
63 lines
3.2 KiB
PowerShell
63 lines
3.2 KiB
PowerShell
$secPassword = ConvertTo-SecureString 'Paper123!@#' -AsPlainText -Force
|
|
$cred = New-Object System.Management.Automation.PSCredential('INTRANET\sysadmin', $secPassword)
|
|
|
|
# Query lockout events from AD1 via AD2 (same subnet hop)
|
|
Invoke-Command -ComputerName 192.168.0.6 -Credential $cred -Authentication Negotiate -ScriptBlock {
|
|
# Query AD1's event log from AD2 (both on same subnet)
|
|
Write-Output "=== Lockout Events (4740) from AD1 ==="
|
|
try {
|
|
$lockouts = Get-WinEvent -ComputerName AD1 -FilterHashtable @{LogName='Security'; Id=4740; StartTime=(Get-Date).AddDays(-7)} -ErrorAction Stop |
|
|
Where-Object { $_.Properties[0].Value -eq 'jlohr' } |
|
|
Select-Object -First 30
|
|
foreach ($e in $lockouts) {
|
|
Write-Output "$($e.TimeCreated) | Caller: $($e.Properties[1].Value)"
|
|
}
|
|
if (-not $lockouts) { Write-Output " None found" }
|
|
} catch { Write-Output " ERROR: $_" }
|
|
|
|
Write-Output "`n=== Kerberos Failures (4771) from AD1 ==="
|
|
try {
|
|
$k = Get-WinEvent -ComputerName AD1 -FilterHashtable @{LogName='Security'; Id=4771; StartTime=(Get-Date).AddDays(-3)} -ErrorAction Stop |
|
|
Where-Object { $_.Properties[0].Value -eq 'jlohr' } |
|
|
Select-Object -First 30
|
|
foreach ($e in $k) {
|
|
Write-Output "$($e.TimeCreated) | IP: $($e.Properties[6].Value) | Status: $($e.Properties[4].Value)"
|
|
}
|
|
if (-not $k) { Write-Output " None found" }
|
|
} catch { Write-Output " ERROR: $_" }
|
|
|
|
Write-Output "`n=== NTLM Failures (4776) from AD1 ==="
|
|
try {
|
|
$n = Get-WinEvent -ComputerName AD1 -FilterHashtable @{LogName='Security'; Id=4776; StartTime=(Get-Date).AddDays(-3)} -ErrorAction Stop |
|
|
Where-Object { $_.Properties[1].Value -eq 'jlohr' -and $_.Properties[2].Value -ne 0 } |
|
|
Select-Object -First 30
|
|
foreach ($e in $n) {
|
|
Write-Output "$($e.TimeCreated) | Workstation: $($e.Properties[0].Value) | Error: $($e.Properties[2].Value)"
|
|
}
|
|
if (-not $n) { Write-Output " None found" }
|
|
} catch { Write-Output " ERROR: $_" }
|
|
|
|
Write-Output "`n=== Logon Failures (4625) from AD1 ==="
|
|
try {
|
|
$f = Get-WinEvent -ComputerName AD1 -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddDays(-3)} -ErrorAction Stop |
|
|
Where-Object { $_.Properties[5].Value -eq 'jlohr' } |
|
|
Select-Object -First 30
|
|
foreach ($e in $f) {
|
|
Write-Output "$($e.TimeCreated) | Source: $($e.Properties[13].Value) ($($e.Properties[19].Value)) | Type: $($e.Properties[10].Value) | Reason: $($e.Properties[8].Value)"
|
|
}
|
|
if (-not $f) { Write-Output " None found" }
|
|
} catch { Write-Output " ERROR: $_" }
|
|
|
|
# Also check AD2's own logs
|
|
Write-Output "`n=== Lockout Events (4740) from AD2 ==="
|
|
try {
|
|
$l2 = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740; StartTime=(Get-Date).AddDays(-7)} -ErrorAction Stop |
|
|
Where-Object { $_.Properties[0].Value -eq 'jlohr' } |
|
|
Select-Object -First 30
|
|
foreach ($e in $l2) {
|
|
Write-Output "$($e.TimeCreated) | Caller: $($e.Properties[1].Value)"
|
|
}
|
|
if (-not $l2) { Write-Output " None found" }
|
|
} catch { Write-Output " ERROR: $_" }
|
|
} -ErrorAction Stop
|