Find the Source of Account Lockouts in Active Directory

In this video I'll show you how to find the source of account lockouts in Active Directory. User accounts that keep locking out can be very frustrating. I'm going to show you 3 solutions including PowerShell and a GUI tool for tracking down the source of account lockouts.

Overview of the steps:

Step 1: Enabling auditing for event 4740

Step 2: Find the domain controller that holds the PDC emulator role

get-addomain | select PDCEmulator

Step 3: Search event logs for event ID 4740

Get-WinEvent -FilterHashtable @{logname=’security’; id=4740}

Step 4: Display details of event

Get-WinEvent -FilterHashtable @{logname=’security’; id=4740} | fl

Step 5: Use event viewer (optional)

Step 6: Using The Unlock GUI Tool

The user unlock tool is a GUI tool that makes is easy to find all locked user accounts and display the source of the account lockout.

Get your copy of the User Unlock Tool for Active Directory

Written version of this tutorial (Includes screenshots)

[vicrao]

This method worked for me on Win Server 2016 Standard. Thank you for making this video, it was a big help.

[seanverdi]

very nice, clear, and to the point with actual command run and output!! !

[tmasst]

Way to go. New Subscriber here due to your amazing help. If the caller computer shows blank esp in Event viewer, how do we decipher then? or do we use powershell?

[shoyeb]

The tool gets the lockout details from the domain controllers but the source computers is not always logged.

[smusig]

Hi! Thanks for the guide here. How would you identify what is actually triggering the lockout on the caller computer name though?

[kasperchristensen]

Hi, I already have a script that sends an email to me and my co workers when a user is locked. But it would be really nice to recive an email when a user has been unlocked. So we can see that somone already unlocked the user again before attempting to do it again. :) Can u help? If i could send you the script i already have?

[pintail]

turning on that audting feature, will it fill up the servers drive space ?

[dinomimo]

as IT support specialists we dont have access on server but we have active directory access, your unlock tool is not free and how can we see where one user is locked not all user with power shell I mean specific user I hope you understand me sir

[mpatton]

what if the caller computer is not a domain joined computer?

[davader]

How would you specify a user? Using PS method

[Techno_Gallery]

Hello.Could you please share User Unlock Tool for Active Directory?

[higlights]

How to find ip address of Locked out account?

[randallforster]

I'm literally suicidal after watching and listening to this video. I'm really rethinking my career choice.