---

Import-Module ActiveDirectory

$DCs = @(
    "ru-dc-p01.sys.clz.ru",
    "ru-dc-p02.sys.clz.ru"
)

$since = (Get-Date).AddHours(-6)

$filter = '(|(sAMAccountName=*Alchevskaya*)(userPrincipalName=*Alchevskaya*)(mail=alchevskayaalena@yandex.ru)(sn=*Алчевская*))'

foreach ($dc in $DCs) {

    Write-Host "`n========== $dc ==========" -ForegroundColor Cyan

    Write-Host "`n[1] SEARCH USER" -ForegroundColor Yellow

    try {
        $users = @(Get-ADUser -Server $dc `
            -LDAPFilter $filter `
            -Properties Mail,WhenCreated `
            -ErrorAction Stop)

        if ($users.Count -eq 0) {
            Write-Host "User NOT FOUND" -ForegroundColor Yellow
        } else {
            $users | Select-Object Name,SamAccountName,Mail,Enabled,WhenCreated |
                Format-List
        }
    }
    catch {
        Write-Host "AD query error: $_" -ForegroundColor Red
    }

    Write-Host "`n[2] SECURITY EVENTS 4720,4738" -ForegroundColor Yellow

    try {
        $events = @(Get-WinEvent -ComputerName $dc `
            -FilterHashtable @{
                LogName   = "Security"
                Id        = 4720,4738
                StartTime = $since
            } -ErrorAction Stop)

        Write-Host "Total account events: $($events.Count)"

        $matches = @($events | Where-Object {
            $_.Message -match "Alchevskaya|Алчевская|Cheridnichenko"
        })

        if ($matches.Count -eq 0) {
            Write-Host "Matching events NOT FOUND" -ForegroundColor Yellow
        } else {
            $matches |
                Select-Object TimeCreated,Id,Message |
                Format-List
        }
    }
    catch {
        Write-Host "Event query: $_" -ForegroundColor Yellow
    }
}