Investigate account lockouts
Documentation: Microsoft Learn
Query Security event ID 4740 from the last eight hours. Inspect the timestamp, logging computer, and message for account-lockout evidence.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-WinEvent -FilterHashtable @{LogName= "Security";Id= 4740;StartTime=(Get-Date).AddHours(- 8)} | Select-Object TimeCreated,MachineName,Message- Stage 1Get-WinEvent
-FilterHashtable - Stage 2Select-Object
Positional values or no named parameters
How it works
A filter hashtable pulls event ID 4740 from the Security log across the last eight hours, and the projection keeps the timestamp, the logging machine, and the message body where the locked account and the originating computer are both recorded.
Adapting it
Extend the AddHours value when the lockouts happen overnight, and pass -ComputerName pointing at the PDC emulator so the query reaches the log that actually holds these records.
Requirements
Rights to read the Security log on a domain controller.
If the result is unexpected
An account-lockout investigation identifies no source machine.
Relevant events may be on a different controller, outside retention or missing useful caller fields.
- Locate the lockout event on the relevant controllers and correlate timestamps with authentication failures.
Validate the result
The evidence ties the account, time and suspected source together without inferring a source from a blank field.
Keep the check reliable
Collect logs promptly and retain controller names with each event.
