Windows Event ID 4740 – Security: User Account Locked Out

Start by examining the 4740 event details in Event Viewer to identify the locked account and source computer.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4740 using the filter option
3. Double-click the most recent 4740 event to view details
4. Note the Account Name, Account Domain, and Caller Computer Name fields
5. Check the timestamp to correlate with user reports or security alerts

Use PowerShell to query multiple 4740 events efficiently:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740} -MaxEvents 50 | Select-Object TimeCreated, @{Name='Account';Expression={$_.Properties[0].Value}}, @{Name='CallerComputer';Expression={$_.Properties[1].Value}} | Format-Table -AutoSize

This command extracts the essential information from recent lockout events, making it easier to identify patterns or repeated lockouts from specific sources.

Investigate the failed logon attempts that led to the account lockout by examining Event ID 4625 (failed logon) events.

1. In Event Viewer, filter the Security log for Event ID 4625
2. Look for events with the same account name from the 4740 event
3. Check timestamps leading up to the lockout time
4. Examine the Failure Reason and Workstation Name fields
5. Identify the source IP address or computer name generating failed attempts

Use PowerShell to correlate 4625 and 4740 events for a specific user:

$LockedAccount = "username"
$StartTime = (Get-Date).AddHours(-2)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625,4740; StartTime=$StartTime} | Where-Object {$_.Properties[5].Value -eq $LockedAccount -or $_.Properties[0].Value -eq $LockedAccount}
$Events | Select-Object Id, TimeCreated, @{Name='Account';Expression={if($_.Id -eq 4625){$_.Properties[5].Value}else{$_.Properties[0].Value}}}, @{Name='SourceIP';Expression={if($_.Id -eq 4625){$_.Properties[19].Value}else{"N/A"}}} | Sort-Object TimeCreated

This analysis reveals the attack pattern and helps determine if the lockout resulted from malicious activity or legitimate user error.

Unlock the affected user account and implement appropriate security measures based on your investigation findings.

1. Open Active Directory Users and Computers (ADUC)
2. Navigate to the user account identified in the 4740 event
3. Right-click the user → Properties → Account tab
4. Check Unlock account if the option is available
5. Click Apply and OK to unlock the account

Use PowerShell to unlock accounts programmatically:

# Unlock a single user account
Unlock-ADAccount -Identity "username"

# Check if account is still locked
Get-ADUser -Identity "username" -Properties LockedOut | Select-Object Name, LockedOut

# Unlock multiple accounts from a list
$LockedUsers = @("user1", "user2", "user3")
$LockedUsers | ForEach-Object {Unlock-ADAccount -Identity $_; Write-Host "Unlocked: $_"}

If the lockout resulted from malicious activity, consider temporarily disabling the account and forcing a password reset:

Set-ADUser -Identity "username" -Enabled $false
Set-ADAccountPassword -Identity "username" -Reset

Service account lockouts require special investigation since they often indicate configuration issues rather than security threats.

1. Identify if the locked account is a service account by checking its naming convention and group memberships
2. Use Services.msc to find services running under the locked account
3. Check Task Scheduler for scheduled tasks using the account
4. Examine IIS application pools if the account is used for web applications
5. Review SQL Server services and their configured service accounts

PowerShell script to find services using a specific account:

$ServiceAccount = "DOMAIN\ServiceAccount"

# Find Windows services using the account
Get-WmiObject Win32_Service | Where-Object {$_.StartName -eq $ServiceAccount} | Select-Object Name, DisplayName, State, StartName

# Find scheduled tasks using the account
Get-ScheduledTask | Where-Object {$_.Principal.UserId -eq $ServiceAccount} | Select-Object TaskName, TaskPath, State

# Check IIS application pools (requires WebAdministration module)
Import-Module WebAdministration -ErrorAction SilentlyContinue
if (Get-Module WebAdministration) {
    Get-IISAppPool | Where-Object {$_.ProcessModel.UserName -eq $ServiceAccount} | Select-Object Name, State
}

Update service credentials after unlocking the account:

# Update Windows service credentials
$Service = Get-WmiObject Win32_Service -Filter "Name='ServiceName'"
$Service.Change($null,$null,$null,$null,$null,$null,"DOMAIN\ServiceAccount","NewPassword")

# Restart the service
Restart-Service -Name "ServiceName"

Deploy comprehensive monitoring solutions to prevent future lockouts and detect security threats early.

1. Configure Windows Event Forwarding (WEF) to centralize 4740 events from all domain controllers
2. Set up automated alerts for multiple 4740 events within short timeframes
3. Implement account lockout threshold monitoring with PowerShell scripts
4. Deploy Microsoft Defender for Identity to detect advanced threats
5. Configure Azure AD Connect Health for hybrid environment monitoring

Create a PowerShell monitoring script for real-time lockout detection:

# Real-time Event 4740 monitoring script
$Query = @"

  
    *[System[EventID=4740]]
  

"@

Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = 4740" -Action {
    $Event = $Event.SourceEventArgs.NewEvent.TargetInstance
    $Message = "ALERT: Account lockout detected - User: $($Event.InsertionStrings[0]) from Computer: $($Event.InsertionStrings[1])"
    Write-Host $Message -ForegroundColor Red
    # Add email notification or SIEM integration here
}

Configure Group Policy settings to optimize account lockout policies:

1. Open Group Policy Management Console
2. Edit the Default Domain Policy or create a new GPO
3. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy
4. Configure appropriate values for Account lockout threshold, Account lockout duration, and Reset account lockout counter after
5. Link the GPO to appropriate OUs and test the settings