Event ID 4767 — Unlocking, a user account

A locked account has been unlocked.

Source of event

Microsoft-Windows-Security-Auditing — Security category.

Possible causes

• Support action
• Administrative unlocking

Verifications to be carried out

1. Identify the author….
2. Check that the cause of the lock has been corrected

Useful orders….

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4767} -MaxEvents 20

To be retained….

An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.