DAU oder doch nicht? AD Kontosperre

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Das Skript muss mit Administratorrechten ausgeführt werden." -ForegroundColor Red  
    exit
}


function Start-UserLogonLogoffMonitoring {
    Param(
        [Parameter(Mandatory = $true)]
        [string]$userName
    )

    $logonEventID = 4624
    $logoffEventID = 4634

    $filterXml = @"  
<QueryList>
  <Query Id="0" Path="Security">  
    <Select Path="Security">  
        *[System[(EventID=$logonEventID or EventID=$logoffEventID)]]
        and
        *[EventData[Data[@Name='TargetUserName']='$userName']]  
    </Select>
  </Query>
</QueryList>
"@  

    $events = Get-WinEvent -FilterXml $filterXml -ErrorAction SilentlyContinue

    if (!$events) {
        Write-Host "Es wurden keine Logon- oder Logoff-Ereignisse für den Benutzer $userName gefunden." -ForegroundColor Yellow  
        return
    }

    $eventHash = @{}
    foreach ($event in $events) {
        $eventHash[$event.RecordId] = $event
    }

    Write-Host "Starte die Überwachung von Logon- und Logoff-Ereignissen für den Benutzer $userName. Drücke [Ctrl+C], um zu beenden."  

    while ($true) {
        $newEvents = Get-WinEvent -FilterXml $filterXml -ErrorAction SilentlyContinue | Where-Object { $_.RecordId -notin $eventHash.Keys }

        foreach ($event in $newEvents) {
            $eventHash[$event.RecordId] = $event

            if ($event.Id -eq $logonEventID) {
                $eventType = "Logon"  
            }
            elseif ($event.Id -eq $logoffEventID) {
                $eventType = "Logoff"  
            }

            $timeStamp = $event.TimeCreated
            $computerName = $event.MachineName

            Write-Host "[$timeStamp] [$eventType] Benutzer $userName angemeldet am Computer $computerName"  
        }

        Start-Sleep -Seconds 1
    }
}

$userName = Read-Host "Gib den Benutzernamen ein:"  
Start-UserLogonLogoffMonitoring -userName $userName

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Das Skript muss mit Administratorrechten ausgeführt werden." -ForegroundColor Red  
    exit
}

function Get-LockedOutUserEvents {
    Param(
        [Parameter(Mandatory = $true)]
        [string]$userName
    )

    $lockoutEventID = 4740
    $unlockEventID = 4767

    $filterXml = @"  
<QueryList>
  <Query Id="0" Path="Security">  
    <Select Path="Security">  
        *[System[(EventID=$lockoutEventID or EventID=$unlockEventID)]]
        and
        *[EventData[Data[@Name='TargetUserName']='$userName']]  
    </Select>
  </Query>
</QueryList>
"@  

    $events = Get-WinEvent -FilterXml $filterXml -ErrorAction SilentlyContinue

    if (!$events) {
        Write-Host "Es wurden keine Sperrungs- oder Entsperrungsereignisse für den Benutzer $userName gefunden." -ForegroundColor Yellow  
        return
    }

    foreach ($event in $events) {
        $eventType = if ($event.Id -eq $lockoutEventID) { "Sperrung" } else { "Entsperrung" }  
        $timeStamp = $event.TimeCreated
        $computerName = $event.MachineName

        Write-Host "[$timeStamp] [$eventType] Benutzer $userName auf dem Computer $computerName"  
    }
}

$userName = Read-Host "Gib den Benutzernamen ein:"  
Get-LockedOutUserEvents -userName $userName