Log on account lockout

Question

We are having issues where peoples accounts are locking out at all times of the day. What we can't nail down is the server/service where these lockouts are initiated from. Is there a way to have a server report a lockout the moment it happens and identify the service that caused it? For example we don't know if it is coming from Exchange OWA, ActiveSync, VPN.

Answer 1

Hi，

Method 1: Using PowerShell to Find the Source of Account Lockouts

The event ID 4740 needs to be enabled so it gets locked anytime a user is locked out. This event ID will contain the source computer of the lockout.

1. Open the Group Policy Management console. This can be from the domain controller or any computer that has the RSAT tools installed.
2. Modify the Default Domain Controllers Policy

Browse to the Default Domain Controllers Policy, right click and select edit.
3. Modify the Advanced Audit Policy Configuration

Browse to computer configuration -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> Account Management

Enable success and failure for the “Audit User Account Management” policy.
Auditing is now turned on and event 4740 will be logged in the security events logs when an account is locked out.

Step 2: Find the Domain Controller with the PDC Emulator Role
If you have a single domain controller (shame on you) then you can skip to the next step…hopefully you have at least two DCs.

The DC with the PDC emulator role will record every account lockout with an event ID of 4740.

To find the DC that has the PDCEmulator role run this PowerShell command

get-addomain | select PDCEmulator

Step 3: Finding event ID 4740 using PowerShell
All of the details you need is in event 4740. Now that you know which DC holds the pdcemulator role you can filter the logs for this event.

On the DC holding the PDCEmulator role open PowerShell and run this command

Get-WinEvent -FilterHashtable @{logname=’security’; id=4740}
This will search the security event logs for event ID 4740. If you have any account lockouts you should a list like below.

To display the details of these events and get the source of the lockout use this command.

Get-WinEvent -FilterHashtable @{logname=’security’; id=4740} | fl

This will display the caller computer name of the lockout. This is the source of the user account lockout.

You can also open the event log and filter the events for 4740

Hope this information can help you
Best wishes
Vicky

Answer 2

Hi,
Welcome to share your current situation if there are any updates.
Please feel free to let us know if you need further assistance.
Best Regards,
Vicky

Answer 3

Hi,
Just checking in to see if the information provided was helpful.
Please let us know if you would like further assistance.
Best Regards,
Vicky

Answer 4

Thank you all for your assistance, it did help us narrow down the issue. We ended up opening paid support with Microsoft to resolve this. It turned out to be a perpetual attack campaign with old credentials. There was two solution implemented.

1) We limited the IP's allowed to communicate with the mail server to just that of our filtering service.

2) We disabled Basic Authentication on the FrontEnd receive connector.