EventID Windows Server

Event ID 4740: A user account was locked out

Windows Server high severity active-directorylockoutsecurity-log
A user account was locked out.

Subject:
  Security ID:		SYSTEM
  Account Name:		DC01$

Account That Was Locked Out:
  Security ID:		CORP\jsmith
  Account Name:		jsmith

Additional Information:
  Caller Computer Name:	WS-0142
On this page

What you see

The user cannot sign in, and the helpdesk unlocks the account. Ten minutes later it locks again. The Security log on the domain controller shows 4740 with the same Caller Computer Name each time.

Why it happens

An account locks after the number of bad passwords set in the domain lockout policy. Something on the network keeps presenting an old password:

  • a mapped drive or Outlook profile with saved credentials
  • a Windows service or scheduled task running as that user
  • a mobile device with a stale Exchange or VPN password
  • an RDP session reconnecting with cached credentials
  • a script or application hard-coding the password

Fix

1. Read the caller computer.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740; StartTime=(Get-Date).AddHours(-24)} |
  ForEach-Object {
    $x = [xml]$_.ToXml()
    [pscustomobject]@{
      Time   = $_.TimeCreated
      Account= $x.Event.EventData.Data | Where-Object Name -eq 'TargetUserName' | ForEach-Object '#text'
      Caller = $x.Event.EventData.Data | Where-Object Name -eq 'TargetDomainName' | ForEach-Object '#text'
    }
  }

In the event text, Caller Computer Name is the machine to investigate. If it shows the DC itself, the source is a service or scheduled task on the DC.

2. On the caller machine, find the process using the account.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-2)} |
  Where-Object { $_.Message -match 'jsmith' } |
  Select-Object TimeCreated, @{n='Type';e={($_.Message -split "`n" | Select-String 'Logon Type') -replace '.*:\s*',''}}

A Logon Type 3 points at SMB or a mapped drive, 4 at Task Scheduler, 5 at a service, 10 at RDP.

3. Clear the cached credential.

On the user’s workstation:

control keymgr.dll

Remove entries for the file server or mail server. Then sign out and back in — a locked Windows session keeps the old token.

4. Fix services and scheduled tasks.

Get-CimInstance Win32_Service | Where-Object { $_.StartName -like '*jsmith*' } |
  Select-Object Name, StartName, State
Get-ScheduledTask | Where-Object { $_.Principal.UserId -like '*jsmith*' } |
  Select-Object TaskPath, TaskName

Update the stored password with sc.exe config <service> password= <new> or in Task Scheduler.

5. Check mobile devices.

Old ActiveSync or VPN clients retry indefinitely. Review Get-MobileDeviceStatistics in Exchange or the VPN concentrator logs.

6. Only then unlock.

Unlock-ADAccount -Identity jsmith

Or net user jsmith /domain /active:yes.

Verify

Watch the DC for 30 minutes after the fix:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740; StartTime=(Get-Date).AddMinutes(-30)}

No new events means the stale credential is gone.

More event IDs