How to find what's locking out
an Active Directory account

Start your free trial

Active Directory (AD) users getting locked out of their accounts is a common issue that sysadmins have to resolve almost every day. A smart way to handle this issue is to identify the source of these lockouts and rectify the root cause. However, this is both exhausting and time-consuming when you have to deal with a large number of locked-out users and have to find the source of each lockout. Below, you'll learn how to find what's locking out an AD account.

Windows Native Auditing
ADAudit Plus

Find what's locking out an AD account using native auditing

Steps to enable auditing using the GPMC

Perform the following actions on the domain controller (DC):

Open the Start menu. Search for and open the Group Policy Management Console (GPMC). You can also run the command gpmc.msc.

How to find what's locking out an Active Directory account

Right-click the domain or organizational unit (OU) where you want to audit account lockouts, and click Create a GPO in this domain, and Link it here.

Note: If you have already created a GPO, click Link an Existing GPO.

Name the GPO.
Right-click the GPO and choose Edit.

In the left pane of the Group Policy Management Editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Account Management.

In the right pane, you will see the list of policies under Account Management. Double-click Audit User Account Management and check the boxes labeled Configure the following audit events, Success, and Failure.

Click Apply and then OK.
Go back to the Group Policy Management Console. In the left pane, right-click the domain or OU that the GPO was linked to and click Group Policy Update. This step makes sure the new Group Policy settings are applied instantly instead of waiting for the next scheduled refresh.

Steps to view the logged events in the Event Viewer

Once the above steps are complete, events will be logged in the event log. These can be viewed in the Event Viewer by following the steps below:

Open the Start menu, search for Event Viewer, and click to open it.
In the left pane of the Event Viewer window, navigate to Windows Logs > Security. Here, you will find a list of all the security events that are logged in the system.

In the right pane under Security, click Filter Current Log.

In the pop-up window, enter 4740 in the field labeled <All Event IDs>.
Click OK. This will provide a list of occurrences of the Event ID you entered.
Double-click the Event ID to view its properties (description).

In the event description, the Caller Computer Name is shown.

To perform a more detailed analysis of the cause of this lockout, carry out the following actions on the DC:

In the Event Viewer, filter the current view to look for the Event ID 4625, which is logged when there is a failed logon.

On the right pane of the Event Viewer window, click Find, enter the name of the user that was locked out, and click Find Next.

Look for an event that was logged after the account lockout time and view its properties.

Scroll down to Caller Process Name. This will show you the location of the process that possibly caused the lockout.

In the above case, the account lockout was called by the process java.exe.

This process requires a lot of effort even for just one end user. To perform this analysis on a large number of end users would be time-consuming, impractical, and ineffective.

With ADAudit Plus, you can perform a thorough analysis of all possible sources of the lockout in just a click using the built-in Account Lockout Analyzer.

Download 30-day, free trial

Find what's locking out AD accounts using ManageEngine ADAudit Plus

Once the audit policies mentioned in the previous section are enabled, follow these steps:

Download and install ADAudit Plus.
Find the steps to configure auditing on your domain controller here.
Open the console and navigate to Reports > Active Directory > User Management > Account Lockout Analyzer.

This will show you a detailed report of locked out accounts sorted by time.

Click on Details under the Analyzer Details column to see the possible reasons behind each account lockout.

Analyze various components that could be causing the lockout with the account lockout analyzer.

Old cached credentials being used by Windows services, scheduled tasks, or other components might be causing these lockouts.

Analyze various components that could be causing the lockout with the account lockout analyzer.
Old cached credentials being used by Windows services, scheduled tasks, or other components might be causing these lockouts.

Advantages of ADAudit Plus over native auditing

View reports on all changes to AD objects, ensuring a foolproof audit trail.
Get instant alerts for unusual user activity and automate responses to these alerts with its built in user behavior analytics engine.
Prove compliance with IT regulations like SOX, HIPAA, GLBA, PCI DSS, FISMA, and the GDPR using out-of-the-box compliance reports.

Download 30-day, free trial

Don't wait for your annual compliance audit.

Audit your AD and Azure
Monitor user logon
Troubleshoot AD lockouts

Starting today

Thank you for your interest in ADAudit Plus!

Our team will be in touch with you shortly.

Active Directory auditing

Windows file auditing

NAS device file auditing

Windows server auditing

Workstation auditing

Entra ID auditing

All features →

Help documents

Video zone

Webinars

Product brochures

Case studies

E-books

Awards zone

Study

How tos

Best practices

How to find what's locking out
an Active Directory account

Find what's locking out an AD account using native auditing

Steps to view the logged events in the Event Viewer

Find what's locking out AD accounts using ManageEngine ADAudit Plus

Advantages of ADAudit Plus over native auditing

Don't wait for your annual compliance audit.

Thank you for your interest in ADAudit Plus!

Related How to

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Identity and access management

Unified service management

Unified endpoint management and security

IT operations management and observability

Security information and event management

Advanced IT analytics

Low-code app development

Cloud solutions for enterprise IT

IT management for MSPs

Active Directory management Manage, track, and secure Active Directory

Identity governance and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service managementDeliver a consistent employee experience across business functions

Customer service managementBuild a one-stop portal for customers with efficient account management

IT asset managementCentralize and automate the complete IT asset life cycle

SIEM Spot, investigate, and neutralize security threats

Log and compliance managementGain deeper visibility into security events and ensure compliance

Security auditingAudit Active Directory, cloud platforms and files to enhance your security posture

Endpoint management and protection platform (UEM and EPP)Secure and manage endpoints to protect your IT assets effectively

Endpoint managementAchieve intelligent IT device management with zero user intervention

Endpoint securityDefend against threat actors with proactive and reactive measures

Full-stack observability and digital experience monitoringAchieve end-to-end visibility, proactive issue resolution, and enhanced security

Network and server performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident managementEfficiently manage and resolve IT incidents while ensuring transparency

DNS and DHCP managementOptimize IP address and domain management

Cloud cost managementRight-size and take control of your cloud costs

IT analyticsConnect to your IT applications and visualize all facets of your IT

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloudand hybrid infrastructure

Business applications for ITBoost productivity and improve team collaboration

Custom solution builderBuild tailor-made apps to automate operations at your organization

Solutions for MSPsGrow your MSP business with scalable and secure IT management solutions

How to find what's locking out an Active Directory account

Find what's locking out an AD account using native auditing

Steps to view the logged events in the Event Viewer

Find what's locking out AD accounts using ManageEngine ADAudit Plus

Advantages of ADAudit Plus over native auditing

Don't wait for your annual compliance audit.

Thank you for your interest in ADAudit Plus!

Related How to

ADAudit Plus Trusted By

Meet all auditing and IT security needs with ADAudit Plus.

A single pane of glass for complete Active Directory Auditing and Reporting

Active Directory
management Manage, track, and secure Active Directory

Identity governance
and administrationOrchestrate user identity management and access controls for Zero Trust

Privileged access
managementControl and secure privileged access to critical enterprise systems

Enterprise and IT service
managementDeliver a consistent employee experience across business functions

Customer service
managementBuild a one-stop portal for customers with efficient account management

IT asset
managementCentralize and automate the complete IT asset life cycle

Network and server
performance monitoringEnsure network, server, and storage reliability with AI-powered insights

IT incident
managementEfficiently manage and resolve IT incidents while ensuring transparency

Cloud-native solutions for IT managementMonitor, manage, audit, and secure your multi-cloud
and hybrid infrastructure

How to find what's locking out
an Active Directory account