Active Directory Login and Lockout Report | PowerShell Script | Find Account Lockouts and Failed Logins | HTML Report | German

A PowerShell script that analyzes the security logs of all domain controllers and displays, in 18 points, which accounts have been locked, which computer the incorrect passwords originated from, and where password attempts are being made. The result: a clear HTML report in German with an explanation and recommendation for each finding.

THIS IS INCLUDED
• PowerShell script Login Lockout Report.ps1 (open source code, commented)
• Instructions as PDF
• Sample report of a test domain (HTML)

THE SCRIPT ONLY WORKS IN READING TIME
It doesn't unlock accounts, delete logs, change anything in Active Directory or on the servers, and doesn't transfer any data. Anything that can't be read directly appears in the report as a finding and is never implicitly considered OK.

THE 18 CHECKPOINTS
• Log: Security log not read or not read completely; failed logins are not logged; security log does not extend back beyond the required time period; events without readable data
• Lockouts: Currently locked accounts with the triggering computer; Account lockouts within the specified period; Repeatedly locked accounts; Administrator account lockouts; Computers triggering lockouts
• Failed attempts: Accounts with many failed attempts; sources with many failed attempts for accounts (password spraying); login attempts with unknown usernames; login attempts with locked, disabled, or expired accounts; failed attempts for administrator accounts; failed logins directly to domain controllers
• Policy and overview: Account lockout is not configured; Account lockout is weakly configured; Interactive logons to domain controllers (console, remote desktop)

REQUIREMENTS
• Windows PowerShell 5.1 and the Active Directory module (present on domain controllers, otherwise RSAT)
• Administrator rights on the domain controllers (to read the security log)
• Tested with Windows PowerShell 5.1 on Windows Server 2025 in a test domain with two domain controllers and one Windows 11 client; each checkpoint was triggered with simulated failed attempts and lockouts, all three read paths (local, remote management, WMI) and the run without administrator privileges were tested. Not tested: older Windows servers, remote desktop logins, multi-domain environments, and very large security logs (runtime).

FOR WHOM
Administrators and IT service providers who want to investigate recurring account lockouts or regularly check for failed logins – without their own monitoring system.

GOOD TO KNOW
• Digital download (ZIP and PDF) – no physical product will be shipped
• Language of script output, report and instructions: German
• The report identifies anomalies based on fixed rules; it does not replace security audits or monitoring.
• Use within your own company or for your own customers; no resale
• Use at your own risk

Note: Content and structure originate from the seller; AI tools were used to assist in its development. All content has been professionally reviewed by the seller.