IT Toolbox
Guide

How to find the source of a Active Directory lock

This method allows you to trace the locked account back to the post, service or equipment using an old password.

TopicActive Directory →
⌚ About 2 min read
View my favorites
Active Directory Intermediate. 20 min

This method allows you to trace the locked account back to the post, service or equipment using an old password.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Find 4740

    Find Caller Computer Name on the domain controller.

  2. 2

    Analyze source

    Look for the 4625 match.

  3. 3

    Inventory

    Check services, tasks, RDP sessions, readers and mobile devices.

  4. 4

    Correct and then monitor

    Update the secret and check it, no new lock.

Commands utiles

The result is that the data are not available for the purposes of this Directive.

À retenir

  • A service account deserves a controlled change window.
  • The source can be a forgotten device.
← All les guides
Technical deep dive

AD authentication: correlate code, DC and account

Technical checkpoints

  • Event ID 4625 contains Status/SubStatus values that distinguish bad password, disabled account, restrictions and other causes.
  • Lockout is logged as 4740 on the DC handling it; Caller Computer Name helps locate the offending host/service.
  • A gMSA depends on the KDS root key, hosts allowed to retrieve its password, SPNs and time/Kerberos

Correlation

Find the event at the exact time and correlate user, source, LogonType and SubStatus.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}
Get-ADUser user -Properties LockedOut,LastBadPasswordAttempt

Topic-specific pitfalls

  • Unlocking the account without removing the bad-password source causes another lockout.
  • A service, scheduled task, phone or mapped drive can keep using an old secret.

How to validate

  • The failure source is identified and 4625/4740 events stop after remediation.
  • The account/gMSA authenticates from the actually affected system.
♡ 0