Goal This guide is written to solve a recurring field issue quickly and verifiably.
Problem
A practical PowerShell query using badPwdCount and badPasswordTime to investigate account lockouts.
PowerShell
Get-ADUser b.ucuncu -Properties badPwdCount,badPasswordTime |
Select-Object SamAccountName,
badPwdCount,
@{Name="LastBadPasswordTime";Expression={
[datetime]::FromFileTime($_.badPasswordTime)
}}What does it show?
badPwdCount shows the bad password count, while badPasswordTime returns the last failed attempt. Because values may differ by Domain Controller, check the relevant DC during a lockout investigation.
Checklist
- Run on a management device with the Active Directory module.
- Verify the user identity.
- Compare the output with event logs and the lockout time.