Event ID 4740… reports the locking of an account in Active Directory after failures a authentication…. Caller Computer Name…. and correlation with the…4625 usually allow to go back to the post, service or equipment that continues to use an old secret….
Source of event
Microsoft-Windows-Security-Auditing — Security category.
Possible causes
An account can be locked again even after a password change if a…. Windows service…., a planned task, a phone, a mail client, a VPN or a persistent session continues to use the old password. Environments with multiple domain controllers also require to consider replication and timestamps. Unlock the account without correcting the source therefore only treats the symptom….
Verifications to be carried out
Identify the domain controller that has updated the…. 4740, then raise…. Caller Computer Name….. Search for…. 4625 around the same schedule to confirm the type a failure and source. If the name a caller is exploitable, then you can use this machine to set up services, scheduled tasks, network players, RDP
- Pick up the time and the account locked….
- Identify Caller Computer Name…
- Correlate with 4625….
- Remove or update the obsolete secret at source….
Useful orders….
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740} -MaxEvents 30Ensure lock is solved…
After correcting the source, unlock the account according to the procedure of the organization and then monitor the new 4740 and 4625 for a sufficient period of time.Check the applications actually used by the account and avoid multiplying the simultaneous changes…. For a service account, document where the secret is configured before any rotation so as not to create other failures.
To be retained….
An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.
FAQ — Event ID 4740
Which field helps the most to find the source?
Caller Computer Name is often the first clue, to complement with 4625 events and account context.
Why does the account lock after a change of password?
A service, task, device or application may continue to use the old secret.
Should we just unlock the account?
No. If the source of the wrong identifiers remains active, the lock will reappear.