Can "Display Name" or "Full Name" be added to 4740 event?

Question

question

MICHAELHENDERSON-5008 asked Apr 11, '22 MICHAELHENDERSON-5008 commented Apr 19, '22

Can "Display Name" or "Full Name" be added to 4740 event?

We need to retrieve the Full Name of an AD user when locked out. It is possible to add that as an attribute or Other information in the Event 4740?

windows-server

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-04-19T08:23:21.643Z

IanXue-MSFT answered Apr 19, '22 MICHAELHENDERSON-5008 commented Apr 19, '22

Hi,

Unfortunately, you cannot add other attributes to an event. However, you can filter the event log with PowerShell and get the DisplayName attribute of the domain account that is locked out using the Get-ADUser cmdlet.

Best Regards,
Ian Xue
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MICHAELHENDERSON-5008 · Apr 19 at 01:01 PM

Thanks for the answer! I was wondering if the Get-ADUser cmdlet can be incorporated into the following Power Shell script (attached)? The results are emailed as you will see. So, I would need the Account name to be used in the Get-ADUser cmdlet to retrieve the display name and send it with the email. So, a challenge, yes.

0 ·

lockoutscript.jpg (717.4 KiB)

question