This is two simple script to check if a account is enable or disable. If enable, a local event will be created. In this example I check if the Guest account is enable, if it is a local event will be generated. You can then pickup that event with a event rule.
strUser = "LDAP://cn=Guest,cn=Users,dc=contoso,dc=internal"Set objUser = GetObject _
 (strUser)
Â
If objUser.AccountDisabled = FALSE Then
 Const EVENT_WARNING = 2
 Set objShell = Wscript.CreateObject("Wscript.Shell")
 objShell.LogEvent EVENT_WARNING, _
       "The account " & strUser & " is no longer disable. Please investigate."
End If
If you want to check all accounts in a OU you can use the this script. It will check a OU named Service_accounts
set objOU = GetObject _
   ("LDAP://OU=Service_Accounts,DC=contoso,DC=internal")
Â
ObjOU.Filter= Array("user")For Each objUser in ObjOU
Â
 strUser = "LDAP://" + objUser.distinguishedName
 Set objUser = GetObject _
  (strUser)
Â
 If objUser.AccountDisabled = FALSE Then
 Const EVENT_WARNING = 2
 Set objShell = Wscript.CreateObject("Wscript.Shell")
 objShell.LogEvent EVENT_WARNING, _
       "The account " & strUser & " is no longer disable. Please investigate."
End If
Next
[…] Monitor AD account Hi Vijay, You can use a script to do that, please take a look at http://contoso.se/blog/?p=199 — Anders Bengtsson Microsoft MVP – Operations Manager Microsoft Certified Trainer (MCT) […]