none
Domain account gets locked out - how do I get the origin of the lockout? RRS feed

  • Question

  • I am trying to determine why a domain account gets locked out of SBS' domain.

    There are problems:
    - logon failure audit is enabled, but there are no records of failed logon attempts for the account in questions  in Security event log
    - the lockout event (4740) is written, but no additional details are given (such as the origin of the error - connection from what device causes lockouts)

    How can I get the details of which device tries to log on, causing lockouts?
    Sunday, February 10, 2019 11:37 AM

All replies

  • hi,
    we can refer below documents first.
    How to Track Source of Account Lockouts in Active Directory
    https://www.lepide.com/how-to/identify-the-source-of-account-lockouts-in-active-directory.html
    How to: Trace the source of a bad password and account lockout in AD
    https://community.spiceworks.com/how_to/48758-trace-the-source-of-a-bad-password-and-account-lockout-in-ad
    How to find the cause of locked user account in Windows AD domain
    https://serverfault.com/questions/547739/how-to-find-the-cause-of-locked-user-account-in-windows-ad-domain
    Please Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Tuesday, February 12, 2019 3:21 PM
  • Is there any progress on your question?

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, February 15, 2019 1:59 AM
  • Is there any progress on your question?

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, February 27, 2019 8:24 AM