Ultimately, I would like to generate a report whereby if a user is locked out (EventCode=4740) the previous 60 minutes log attempts are recorded showing source machine and also the machine which the user is attempting to connect to.
I will then go on to generate a script to put this in to e-mail format so that I can automatically e-mail the user with this report when they are locked out.
Can anyone help? To clarify, the EventCode=4740 would be the trigger and then I would need the previous 60 minutes log attempts including source machine and destination machine in a report. Would this be a transaction or span command?
This will result in giving us the Time, Account, and Machine where the lockout occurred but it doesn't include the previous logs. We have it setup to then email our HelpDesk team inbox so they can reach out to the user (fortunately we are a small enough company this is reasonable).