Active Directory Account Lockout: Diagnose and Fix

# Search the Security log on the PDC for lockout events for a specific user
$PDC = (Get-ADDomain).PDCEmulator
Get-WinEvent -ComputerName $PDC -FilterHashtable @{
    LogName   = 'Security'
    Id        = 4740
} | Where-Object { $_.Properties[0].Value -eq "jsmith" } |
  Select-Object TimeCreated,
                @{N='LockedUser';  E={ $_.Properties[0].Value }},
                @{N='SourceMachine'; E={ $_.Properties[1].Value }}

# Run on the source machine or via Invoke-Command
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4625 } -MaxEvents 50 |
  Select-Object TimeCreated,
                @{N='User';    E={ $_.Properties[5].Value }},
                @{N='LogonType'; E={ $_.Properties[10].Value }},
                @{N='ProcessName'; E={ $_.Properties[18].Value }}

# List all stored Windows Credentials via cmdkey
cmdkey /list

# Delete a specific stored credential
cmdkey /delete:target_name_here

# Remove and re-map a drive with updated credentials
net use Z: /delete
net use Z: \\server\share /user:DOMAIN\jsmith CurrentPassword /persistent:yes

# Find all tasks running as a specific user
Get-ScheduledTask | Where-Object { $_.Principal.UserId -like "*jsmith*" } |
  Select-Object TaskName, TaskPath

# List ActiveSync devices for a mailbox
Get-MobileDeviceStatistics -Mailbox "jsmith" |
  Select-Object DeviceFriendlyName, LastSyncAttemptTime, Status

# Monitor lock status (run repeatedly or wrap in a loop)
Get-ADUser -Identity "jsmith" -Properties LockedOut, BadLogonCount, LastBadPasswordAttempt |
  Select-Object Name, LockedOut, BadLogonCount, LastBadPasswordAttempt