Hello

When admin Disable or Enable the Domain User Account. Mail Notification should be sent.
Below the script when i tried with Event ID

Define SMTP and email parameters

$SMTPServer = "smtp.yourdomain.com"

$From = "******@yourdomain.com"

$To = "******@yourdomain.com"

Get recent Security events for account enable/disable

$EventIDs = @(4722, 4725)

$Events = Get-WinEvent -FilterHashtable @{

LogName = "Security" 

Id = $EventIDs 

} -MaxEvents 5

foreach ($Event in $Events) {

# Extract event details 

$EventID = $Event.Id 

$Action = if ($EventID -eq 4722) { "Enabled" } else { "Disabled" } 

$Time = $Event.TimeCreated 

$Details = $Event.Properties 

# Output event properties for inspection 

Write-Output $Details 

# Adjust indexes based on inspection 

$TargetAccount = $Details[5].Value    # Affected account (Check this index) 

$Initiator = $Details[1].Value       # Admin who initiated the action (Check this index) 

$TargetOU = $Details[6].Value        # Organizational Unit of the account (Check this index) 

# Email body 

$Body = @" 

AD Account Status Changed: 

Action: $Action 

Account: $TargetAccount 

Changed By: $Initiator 

Target OU: $TargetOU 

Time: $Time 

"@ 

# Send email 

Send-MailMessage -SmtpServer $SMTPServer -From $From -To $To -Subject "AD Account Status Changed" -Body $Body 

}

Result:-
Getting mail notification

Action: Enabled

Account: TLS

Changed By:

Target OU:

Time: 11/27/2024 07:53:00

Not Getting Exact Domain User for
Account: TLS

Changed By:

Target OU:

What is missing?