none
Automatic unlock event ID? RRS feed

  • Question

  • When the "Account Lockout Duration" policy is configured, "This security setting determines the number of minutes a locked-out account remains locked out before automatically becoming unlocked."

    Is  there any Event ID triggered when this occurs?

    We like to sync this state to a different user directory, but we need to catch the event. The easiest way would be through event IDs.

    Manual unlocking of accounts triggers the event ID "4767", but this is not triggered for automatic unlock events.

    Regards,

    Ruben

    Friday, June 10, 2016 7:13 AM

Answers

  • Hi,

    Thanks for your post.

    Yes, no event ID will be logged when user accounts automatically unlocked.

    This is different from when an administrator unlocks an account that gets logged. When group policy or the local security policy has a duration enabled such that accounts are automatically unlocked after X minutes it doesn't appear that this generates any sort of event.

    What we can do is catching the account lockout events and making a judgement based on the account lockout settings.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by ruben.demey Wednesday, June 15, 2016 7:51 AM
    Monday, June 13, 2016 3:01 AM
    Moderator

All replies

  • Hi,

    Thanks for your post.

    Yes, no event ID will be logged when user accounts automatically unlocked.

    This is different from when an administrator unlocks an account that gets logged. When group policy or the local security policy has a duration enabled such that accounts are automatically unlocked after X minutes it doesn't appear that this generates any sort of event.

    What we can do is catching the account lockout events and making a judgement based on the account lockout settings.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by ruben.demey Wednesday, June 15, 2016 7:51 AM
    Monday, June 13, 2016 3:01 AM
    Moderator
  • Hi,

    Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 15, 2016 7:50 AM
    Moderator
  • Hello,

    is no Event ID logged also if the account gets unlocked by a VBScript?

    Or does the unlocking cause some other Event ID maybe?

    Thank you very much.


    • Edited by Ax Plains Thursday, February 22, 2018 3:41 PM
    Thursday, February 22, 2018 10:26 AM