Unlock AD account across multiple domain controllers quickly.

egrizzly

At work once an AD account gets locked we have to unlock them individually across about 6 Domain Controllers. This means selecting File > Change Domain Controller each time to select each individual DC and unlock the account there. Holy Jupiter!!! somebody please tell me there's a faster way to do this.

btw, if you open the AD account properties and just place checkmark on "unlock account" it only unlocks the account on the already selected DC.

I'm still hunting around the web for a faster way to do this but please guys if you have any knowledge on that answer feel free to jump in the discussion.

NetworkNewb

Simple AD Account Mgmt - Multi-domain support: Search-User.ps1 - Script Center - Spiceworks

linuxabuser

Enable AD Urgent Replication.

egrizzly

linuxabuser wrote: »

Enable AD Urgent Replication.

wow, I was thinking about something from the help desk agent level. Urgent Replication seems like it has to be done by the Sr. Systems Engineer.

techfiend

I think a ps1 like this should work, can't test right now. Need to set the domains and change the user.

$name = "user"

Unlock-ADAccount -Identity "$name, DC=domain1,DC=COM"
Unlock-ADAccount -Identity "$name, DC=domain2,DC=COM"
Unlock-ADAccount -Identity "$name, DC=domain3,DC=COM"

TheFORCE

egrizzly wrote: »

At work once an AD account gets locked we have to unlock them individually across about 6 Domain Controllers. This means selecting File > Change Domain Controller each time to select each individual DC and unlock the account there. Holy Jupiter!!! somebody please tell me there's a faster way to do this.

btw, if you open the AD account properties and just place checkmark on "unlock account" it only unlocks the account on the already selected DC.

I'm still hunting around the web for a faster way to do this but please guys if you have any knowledge on that answer feel free to jump in the discussion.

You hunting the web when the only place you need to go is the Microsoft site.Have you tried the Account Lockout tool Microsoft has? Link below.
It is an executable file that you just run from your desktop, enter the domain information once and the the tool will find all the domain controllers available on your network. This way, when a user gets locked out, all you have to do is enter the username on the tool and it will find all the domain controllers the account is locked out on. You can enable the account on the primary domain first and then just click unlock on all the rest. Basically a 5 second job. Below is a picture of how the tool looks like

https://www.microsoft.com/en-us/download/details.aspx?id=15201