For Windows computers, every shutdown or restart is logged in the Event Viewer so you know what exactly happened, whether it’s a system triggered reboot, or by a user specifically, or a restart because of a system or application crash. So, if you want to dig into this information, all you need is to open Event Viewer, head into System […]
When retrieving data from the event log, there is a set of data stored in a data field called ReplacementStrings that is very useful to the certain types of log entries. It’s structured as a string array, therefore, can be retrieved if you know the data structure. The problem is, every type of event ID has different string array structure. […]
If a user account gets locked out, I can follow these tips to find out why and when it happened. But how can I check and gather lockout info along with the bad password attempts info of all users across the entire AD domain? Asking help from PowerShell is my answer. There are two places where we can gather this […]