Direct Inward Dialing: +1 408 916 9892
Getting locked out of their accounts is one of the most common issues that Active Directory (AD) users face, and unlocking these accounts is a task admins spend a considerable amount of time on. Any account unlocked by an unauthorized admin or a compromised admin account could have long-lasting security consequences. For this reason, it's imperative to keep track of every detail behind account unlock events. Read on to learn how to detect who unlocked a user account in AD.
Perform the following actions on the domain controller (DC):
Note: If you're using a workstation, run the following script in PowerShell:
Get-EventLog -LogName Security -ComputerName <DC name>| Where-Object {$_.EventID -eq 4767} | Select-Object -Property *
where
The above steps are an exhausting and time-consuming way to retrieve the details about account unlock events, but there's an easier way to get the same results.
Introducing ManageEngine ADAudit Plus, a comprehensive AD auditing solution that provides built-in reports for critical security events such as those above. Check out how ADAudit Plus does this and much more by downloading a 30-day free trial.
Although it's possible to search for account lockout events using native auditing, it becomes impossible for organizations to do this on a day-to-day basis due to the high volume of events logged. ADAudit Plus monitors account lockouts in real time, and reports on frequently locked and unlocked user accounts. Its account lockout analyzer tool allows you to discover the source of each lockout by analyzing where the cached credential was used; for instance, in scheduled tasks, Windows services, or other applications.
Follow these best practices to keep account lockouts to a minimum.
ADAudit Plus uses user behavior analytics (UBA) to create a baseline of normal user activity, and alerts you when any user deviates from that behavior. You can also see if lockouts occurred during non-business hours; this insight can help you detect brute-force attacks and find compromised devices in your network.
