I think it only works for Windows server 2008. I tried using Alockout.dll on the windows server 2012 R2 but it doesn't produce any logs. I don't see any scheduled tasks running with that username. I think the account is locked almost every 90 minutes close to GPupdate run. Its a Windows server 2012 R2 running only WSUS service.

Open an issue there if you find a bug with this code, or maybe you’d like to suggest an improvement.One of my account is being locked out from a windows server, it was tracked down using the Security Audit which produced event ID 4740. You’ll notice that I also added a couple of parameter sets to it so that you can filter for certain users as well as filter for certain times as far left as possible.Īnd don’t forget that you can also find this code in my Github Utilities repo. In this case, the security log:įunction Get-ADUserLockouts At a bare minimum, we need to include the logname that we are querying. To retrieve event logs from a remote computer that allows remote event log management, we’ll use the Get-WinEvent cmdlet. Specifically the Caller Computer as it calls it, and we can grab all of that information with PowerShell! The command Obviously the date, time, and account that was locked out, but it also includes information about where the lockout originated from. Inside that event, there are a number of useful bits of information. Whenever an account is lockedout, EventID 4740 is generated on the authenticating domain controller and copied to the PDC Emulator. Backgroundīefore we dive into building the tool, I want to make sure we are on the same page.

The good news is that even though it can take a bit of time to filter through logs, if you do some leg work ahead of time with PowerShell we can cut down the time to a few seconds. It is clearly your fault, definitely not the fact that they never changed the password on their iPad that is syncing with Exchange. Especially when a user asks you to unlock their account 2 minutes after the last time they asked. One very frustrating task to accomplish for a sysadmin is tracking down why an account has been locked out. I can’t say for certain that account lockouts will always happen on the PDC and no where else, but in a perfect world that should hold true. Update: I had a question about checking other DCs beyond just the PDC, according to Microsoft:Īccount lockout is processed on the PDC emulator. Tracking down account lockout sources with PowerShell

Windows doamin event account locked