This is a guide to the Splunk “Lockout Events (AD)” Dashboard, which includes two different reporting sections, Lockouts with Source and DC (Domain Controller), and Lockout Stats. Splunk dashboard is intended as a replacement for the PowerShell script driven lockout reporting system, which results in a CSV being published to the ET&S Help Desk Services Sharepoint.

This article provides guidance on installing the Active Directory Users and Computers (ADUC) module on both Windows 10 and Windows 11 - with instructions on pinning its icon to the taskbar for easy access, as well as running the module as a "different user" with an administrative (ADM) account.