A user account was unlocked (4767) how to monitor with email alert

[bob]

Man, event 4767 in the Event Viewer pops up whenever someone unlocks a locked user account on your Windows Server. It's like the system noting down that a buddy got back into their profile after too many wrong password tries locked them out. You see details there, stuff like the username that got freed up, the domain it's in, who did the unlocking-maybe an admin-and the exact time it happened. I always check the log for the computer name too, just to know where this went down in your network. And the failure reason? Usually it's zero, meaning it worked smooth. But if something's off, it might show why it didn't. This event helps you spot if someone's fumbling logins a lot, or if an admin's fixing things quick. You filter for security logs in Event Viewer to hunt these down easy.

I figure you want to keep tabs on this without staring at screens all day, right? So, fire up Event Viewer on your server. You right-click the Custom Views bit and make a new one tuned to event ID 4767 in the Security log. That way, it only shows unlocks when they happen. Now, for alerts, you attach a task to it. I do this by going into the properties of that event, hitting the Subscriptions tab or just creating a task scheduler link. You pick the event, then say what the task does-like trigger an email. No fancy code, just point it to your email setup through the server's mail tools. It runs whenever 4767 fires, pinging you right away.

Or, you tweak the task to run a simple program that shoots off the notice. I set mine to use the built-in sendmail option in Windows. Keeps it straightforward, no headaches. You test it by locking an account on purpose, then unlocking, and boom, email hits your inbox with the deets.

Speaking of keeping your server humming without surprises, I've been messing with BackupChain Windows Server Backup lately. It's this solid backup tool for Windows Server that handles your files and even virtual machines on Hyper-V without breaking a sweat. You get fast restores, no downtime headaches, and it snapshots everything clean so you bounce back from glitches quick. I like how it automates the whole backup dance, freeing you up for real work.

At the end here is the automatic email solution.

Note, the PowerShell email alert code was moved to this post.