Frage Microsoft Windows Server

gelöst ActiveDirectory Benachrichtigung

<?xml version="1.0" encoding="UTF-16"?>

<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">

  <RegistrationInfo>

    <Date>2018-06-27T16:24:20.6615784</Date>

    <Author>Domain\Administrator</Author>

  </RegistrationInfo>

  <Triggers>

    <EventTrigger>

      <Enabled>true</Enabled>

      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Security"&gt;&lt;Select Path="Security"&gt;*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4740]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>

      <ValueQueries>

        <Value name="TargetDomainName">Event/EventData/Data[@Name='TargetDomainName']</Value>

        <Value name="TargetSid">Event/EventData/Data[@Name='SubjectUserSid']</Value>

        <Value name="TargetUserName">Event/EventData/Data[@Name='TargetUserName']</Value>

      </ValueQueries>

    </EventTrigger>

  </Triggers>

  <Principals>

    <Principal id="Author">

      <UserId>S-1-5-18</UserId>

      <RunLevel>HighestAvailable</RunLevel>

    </Principal>

  </Principals>

  <Settings>

    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>

    <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>

    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>

    <AllowHardTerminate>true</AllowHardTerminate>

    <StartWhenAvailable>false</StartWhenAvailable>

    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>

    <IdleSettings>

      <StopOnIdleEnd>true</StopOnIdleEnd>

      <RestartOnIdle>false</RestartOnIdle>

    </IdleSettings>

    <AllowStartOnDemand>true</AllowStartOnDemand>

    <Enabled>true</Enabled>

    <Hidden>false</Hidden>

    <RunOnlyIfIdle>false</RunOnlyIfIdle>

    <WakeToRun>false</WakeToRun>

    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>

    <Priority>7</Priority>

  </Settings>

  <Actions Context="Author">

    <Exec>

      <Command>powershell</Command>

      <Arguments>-Executionpolicy ByPass -NoProfile -Command "Send-MailMessage -From 'sender@domain.de' -to 'receiver@domain.de' -SmtpServer 'server.domain.de' -Subject \"Benutzer '$(TargetUserName)' wurde gesperrt. Quellcomputer: '$(TargetDomainName)'\" -Credential (new-Object PSCredential('USERNAME',(ConvertTo-SecureString 'PASSWORD' -AsPlainText -Force)))"</Arguments>

    </Exec>

  </Actions>

</Task>