IT Toolbox
Menu
Français
HomeHow to find the source of a Active Directory lock
Guide

How to find the source of a Active Directory lock

Trace Active Directory account lockouts using Event ID 4740, the caller computer and services or devices using outdated credentials.

TopicIT resources → About 1 min read

This method allows you to trace the locked account back to the post, service or equipment using an old password.

Steps.

  1. Find 4740 — Find Caller Computer Name on the domain controller.
  2. Analyze source – Search for the 4625 correspondents.
  3. Inventory — Check services, tasks, RDP sessions, readers and mobile devices.
  4. Correct and then monitor – Update the secret and check it, no further lock.

Commands

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740}

Key takeaways

  • A service account deserves a controlled change window.
  • The source can be a forgotten device.

See also:. Event ID 4740..

Related resources

Relevant topic Active Directory account locks in loop The account is unlocked and then locks again quickly Relevant topic Active Directory replication failed One or more domain controllers no longer respond correctly Relevant topic Active Directory secure channel is broken A post or server indicates that the d, approval relationship with the domain failed Relevant topic Add a new Active Directory site Controlled procedure to add a new active site Relevant topic Diagnose degraded Active Directory replication Structured procedure before intrusive action on domain controllers
Support the development of BAOI Hosting, domains and new IT resources.
❤️ Support BAOI

My favorites