Triggering An NMcap Capture When A Certain Event ID Repeats

Question

Lately we have been having an issue in our Active Directory environment where a subset of users will all be locked out. This happens at random, unpredictable
times. Sometimes weeks or months apart, sometimes twice in a few days. After talking to Microsoft Support and using various tools and investigating Event IDs, we are getting no leads of what may be causing it. All events have no source IP address, but the
source computer name is seemingly random and does not exist in our Active Directory, nor does it resolve via DNS. It is usually the same users, but every once in a while there will be some additional users affected. We have also triaed using NetWrix Account
Lockout Examiner with no luck.
Our Microsoft tech told us that we could set up an NMcap session to trigger when accounts start to get locked out, to see where the NTLM traffic
is coming from.
Here is what he told us:
"You could also leverage NMCap by tying it to an event trigger.  For example, a 4625 or 4740 event on the local
resource server could be set to trigger a batch file that kicks off the capture for a specific period of time:
NMCap /network * /capture /file test.cap /stopwhen /timeafter 20min "
It would be ideal, in theory, to set up some sort of logic, for example:
if three accounts are locked out within 20 seconds,
then start the capture, 
and append the file name with the date / time.
I am unsure of how to go about this. I have looked at the task scheduler, but there doesn't seem to be much logic available. We can get it to trigger
on a specific event ID, but it's not ideal for the capture to start every time a user is locked out, as that is a part of day-to-day business. I also don't see a way for this NTLM command to append the file name, it seems like it would use the same filename
and possible overwrite itself.
Any help is much appreciated.  Thanks everyone!

Answer 1

Hi,
Based on my research, we can use a schedule task to trigger Network Monitor to capture network traffic when a specific event is logged, although to achieve you goal which has complex conditions, it may require a script.
Here are some related examples for you:
Fire & Forget – How to Stop a Network Trace Programmatically using Network Monitor
http://blogs.technet.com/b/askpfeplat/archive/2013/05/20/fire-amp-forget-how-to-stop-a-network-trace-programmatically-using-network-monitor.aspx
Forum FAQ: How to configure a schedule task which is triggered by an event?
http://social.technet.microsoft.com/Forums/windowsserver/en-US/fac16f3c-d088-4d66-83d8-7139261dea83/forum-faq-how-to-configure-a-schedule-task-which-is-triggered-by-an-event
EventMon: Stopping a Capture Based on an EventLog Event
http://blogs.technet.com/b/netmon/archive/2007/02/22/eventmon-stopping-a-capture-based-on-an-eventlog-event.aspx
You can also refer to The Official Scripting Guys Forum to get professional support in regard to scripting:
The Official Scripting Guys Forum
http://social.technet.microsoft.com/Forums/scriptcenter/en-US/home?forum=ITCG
Best Regards,
Amy