← cd ~/events
// events/4740 · Accounts
Event ID 4740A user account was locked out
An account hit the lockout threshold. It is logged on domain controllers, member servers and workstations. Caller Computer Name shows the computer the failed logon attempt came from.
| Log | Security |
|---|---|
| Source | Microsoft-Windows-Security-Auditing |
| Area | Accounts |
What to check
Start at the Caller Computer Name to find what is sending bad passwords, and alert when it is a computer the account should not use or one outside your domain.
Find it with PowerShell
Run on the machine that logs it, as an administrator.
Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 4740 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4740
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated descRelated Accounts events
- Event ID 4720: A user account was created
- Event ID 4722: A user account was enabled
- Event ID 4723: An attempt was made to change an account's password
- Event ID 4724: An attempt was made to reset an account's password
- Event ID 4725: A user account was disabled
- Event ID 4726: A user account was deleted
- Event ID 4738: A user account was changed
- Event ID 4767: A user account was unlocked