#!perl
############################################################
#
# ITS Locked Account Monitor Script
# 
# v1.0 - Walt Howd  
#
#
# This script is designed to monitor the number of locked accounts. If this number rises it will notify
# an administrator via e-mail.
# 	
#
# REQUIREMENTS:
# 1. unlock.exe in the PATH (http://www.joeware.net/win/free/tools/unlock.htm)
#
############################################################

############################################################
# Global Variables
############################################################
$lockedThreshold 	= 10;				
$unlockCmd 		= "unlock.exe . * -view 2>NUL";	
@notifyList		= qw( 
				admin
			     );			
$mailFrom		= "AccountLockout";
$mailSubject		= "Account Lockout Alert";
$mailServer		= "mailserver.domain.com";
$mailBodyHeader		= <<END;
There are currently a high number of locked out accounts.

This might be due to a bruteforce attack or a misconfigured system. Please check the security logs on the domain controllers.

This script is currently set to notify you when there are more then $lockedThreshold locked accounts.

----------------------------------------
Username - Account Lockout Time
----------------------------------------
END
			  
##############################################
# We required the Net:SMTP module to send e-mail
##############################################
use Net::SMTP;

##############################################
# Print starting banner
##############################################
($sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst)=localtime(time);
printf "\nITS Locked Account Monitor Script started at %4d-%02d-%02d %02d:%02d:%02d\n\n",$year+1900,$mon+1,$mday,$hour,$min,$sec;

############################################################
# Count number of locked accounts
############################################################
$unlockText 	= `$unlockCmd`;
while($unlockText =~ /LOCKED/g) { $lockedCount++ }
print "There are currently $lockedCount locked out account(s)\n\n";

############################################################
# Exit if no locked accounts were found
############################################################
if ($lockedCount < 1) { exit; }

############################################################
# Display locked out accounts
############################################################
foreach(split('\r\n?|\n', $unlockText)) {
	@words = split(/[ ]+/);
	$lockedAccountsList .= $words[1] . " - " . $words[2] . "\n";
}
print $lockedAccountsList . "\n";

############################################################
# If the number of locked out accounts is above the defined threshold then send an e-mail to the
# administrators notify list
############################################################
if ($lockedCount >= $lockedThreshold ) {
	$smtp = Net::SMTP->new($mailServer);
	foreach (@notifyList) {		
		$mailTo = $_;	

		print "Notifying $mailTo via e-mail. . .\n\n";
			
		$smtp->mail($mailFrom);
		$smtp->to($mailTo);
		$smtp->data();
		$smtp->datasend("Subject: $mailSubject\n");
		$smtp->datasend("From: $mailFrom\n");
		$smtp->datasend("To: $mailTo\n");
		$smtp->datasend("\n");
		$smtp->datasend($mailBodyHeader	. $lockedAccountsList);
		$smtp->dataend();		
	}	
	$smtp->quit;
}