Windows logon security audit toolkit — logon history, failed attempts, account lockouts, session tracking, and authentication method analysis

Audit Active Directory password and lockout policy, Fine Grained Password Policy and stale / never-expire accounts. Requires the ActiveDirectory module.

When the Security event log is set to Do Not Overwrite (LogMode=Retain) and fills up, Windows can flip CrashOnAuditFail to 2, which locks out every non-administrator until the log is cleared. This script catches the condition early and remediates it: it resizes the log, sets it to overwrite as needed, and - if the lockout has already tripped - arch... More info