Determining the Cause of AD Account Lockout

When an account in Active Directory is locked out, the main reason is almost always related to failed authentication attempts that exceed the threshold set by the lockout policy. To determine the exact cause of the lockout, you need to check the security logs on domain controllers, especially Event ID 4740, which is logged specifically on domain controllers (unlike Event ID 4625, which is only visible on client computers).

• Main methods for determining the cause of lockouts
• Step-by-step instructions for finding the source of lockouts
• Common causes of account lockouts
• Additional tools and diagnostic methods
• Preventing repeated lockouts

Main methods for determining the cause of lockouts

The main method for determining the cause of a lockout is analyzing the security logs on domain controllers, where Event ID 4740 is logged. This event contains important information about which account was locked out and from which computer the lockout occurred.

Unlike Event ID 4625, which you checked on the client computer and which is not always visible during a lockout, Event ID 4740 is always logged on the domain controller acting as the PDC Emulator. This is where the main information about the account lockout is located.

Important: Event ID 4740 contains a ‘TargetUserName’ field with the name of the locked user and a ‘ClientName’ field with the name of the computer that initiated the lockout.

Step-by-step instructions for finding the source of lockouts

Step 1: Determine the domain controller with the PDC Emulator role

1. Open PowerShell as an administrator
2. Run the command:

Get-ADDomain | Select-Object PDCEmulator

This command will show you which domain controller is acting as the PDC Emulator - that’s where you need to look for lockout events.

Step 2: Search for Event ID 4740 in the security log

1. Connect to the domain controller with the PDC Emulator role
2. Open “Event Viewer”
3. Go to “Windows Logs” → “Security”
4. In the event filter, specify Event ID 4740
5. Analyze the found events:

| Event Parameter | Value | Description |
|------------------|----------|----------|
| Event ID | 4740 | Account locked out |
| TargetUserName | Username | Locked account |
| ClientName | Computer name | Computer that initiated the lockout |
| LogonType | Logon type | 2-Interactive, 3-Network, 4-Batch, etc. |
| Workstation Name | Workstation name | Computer from which the logon was attempted |
| Caller Process Name | Initiating process | User process or service |

Step 3: Analyze the logon type (LogonType)

The logon type specified in event 4740 helps determine the cause of the lockout:

• LogonType 2 (Interactive) - logon attempts from an interactive session
• LogonType 3 (Network) - network authentication (shared folders, printers)
• LogonType 4 (Batch) - batch processing (scheduler tasks)
• LogonType 8 (NetworkCleartext) - authentication in clear text
• LogonType 9 (NewCredentials) - using new credentials

Common causes of account lockouts

1. Saved outdated credentials

The most common cause - applications or devices that store old user credentials. This can be:

• Outlook or other email clients
• RDP connections with saved passwords
• Shared network folders with automatic connection
• Mobile devices with cached passwords
• Browsers with saved passwords

2. Scheduled tasks and services

Windows Task Scheduler often uses accounts to automatically execute tasks:

1. Check scheduled tasks on user computers:

Get-ScheduledTask -TaskPath "\" | Where-Object {$_.Settings.StartWhenAvailable -eq $true}

2. Pay attention to tasks that run under the user account

3. Network connections and printers

Old network connections or printers may try to use invalid credentials:

• Disconnected network drives
• Removed network printers
• Virtual applications that save passwords

4. Malware or attacks

If the lockout occurs from many different computers, it may be a sign of:

• Brute-force attacks on the account
• Malware using credentials
• Compromised account by attackers

Additional tools and diagnostic methods

Enabling advanced Netlogon logging

For more detailed diagnostics, you can enable Netlogon debugging on the PDC Emulator:

1. Open the registry on the PDC Emulator
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
3. Create a DWORD parameter named EnablePdcDebugLogging with a value of 1
4. Restart the Netlogon service
5. After a few hours, check the System log for detailed messages

Using PowerShell for analysis

The following PowerShell command will help find recent lockout events:

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4740} | 
Select-Object TimeCreated, @{Name="User";Expression={$_.Properties[0].Value}}, 
@{Name="Computer";Expression={$_.Properties[1].Value}} | 
Sort-Object TimeCreated -Descending | Format-Table

Netstat command to find active connections

If the lockout is coming from a specific computer, check active network connections:

netstat -anb | findstr "445 139 389"

This command will show processes using network protocols related to authentication.

Analyzing domain policies

Check domain lockout policy parameters:

Get-ADObject -Identity (Get-ADDomain).DistinguishedName -Properties * | 
Select-Object Name, LockoutThreshold, LockoutDuration, LockoutObservationWindow

Preventing repeated lockouts

1. Regular account auditing

Conduct regular audits of:

• Saved passwords in applications
• Scheduled tasks
• Network connections
• Devices connected to the domain

2. Using modern authentication methods

Switch to more secure methods:

• Multi-factor authentication (MFA)
• Certificates instead of passwords
• Smart Card authentication

3. Monitoring and alerts

Set up monitoring for:

• Event ID 4740 for immediate notifications
• Multiple failed authentication attempts
• Unusual lockout activity

4. User training

Conduct user training on:

• Proper password management
• Secure credential storage
• Reporting suspicious activity

Conclusion

Determining the cause of an account lockout in Active Directory requires a systematic approach and analysis of various information sources. Key points to remember:

1. Event ID 4740 on the domain controller with the PDC Emulator role is the primary source of information about lockouts
2. Logon type helps understand the nature of the lockout - interactive, network, or batch
3. Most common causes - outdated saved passwords, scheduled tasks, and network connections
4. Advanced diagnostics using Netlogon debugging and PowerShell helps in complex cases
5. Preventive measures - regular auditing and user training help avoid repeated lockouts

By following these steps, you can not only determine the current cause of a lockout but also develop a strategy to prevent similar situations in the future.

Sources

1. Account Lockout Event ID: Find the Source of Account Lockouts
2. How to Troubleshoot Account Lockouts in Active Directory (Step-by-Step Guide)
3. Find Account Lockout Source and Cause in Active Directory
4. Identify Source of Active Directory Account Lockouts: Troubleshooting
5. Account Lockout Event ID 4740 – View Locked Account Details
6. Active Directory: Account Lockouts - Find Source/Cause (Bonus: Account Modifications)
7. Diagnosing Account Lockout in Active Directory | Lumifi Cybersecurity
8. How can I find the source of a repeated Active Directory Locked out user?? - Microsoft Q&A
9. How to trace and diagnose account lockout in AD
10. Account Lockout Event ID: How to Find Account Lockouts - Windows Active Directory