Home · Lessons

Account triage

How to find why an account keeps locking

Unlocking an account fixes the symptom. If the account locks again, something is still sending the wrong password. The domain controller's Security log records where the bad attempts came from.

1. Unlock first, then investigate

Unlock the account so the user can work, and confirm you have the right person. Then find out why it locked. If you skip the second part, the lockout will be back within minutes.

Get-ADUser -Identity msantos | Unlock-ADAccount

2. Know what the lockout event is

When an account locks, Windows writes event 4740 in the Security log of the domain controller that handled it. The event names the locked account and the Caller Computer Name, which is the machine the bad passwords came from. Failed sign-ins are event 4625, but they are on the machine where the attempt happened, so start with 4740.

3. Read the log

Use the event ID to filter the Security log:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740}

Find the event for your user's account and read the caller computer name. In a larger domain with several controllers, the lockout is usually recorded on the PDC emulator, so check there too.

4. Work out what the caller is

The caller name tells you where to look next:

• The user's own laptop or desktop: a saved password in a mapped drive, a credential manager entry, or a scheduled task is using the old password.
• A mail server or gateway: a phone or mail client is still using the old password, which is common after a reset.
• A server nobody expected: a service or script runs under the user's account. Check with the server's owner before you change anything.
• A machine the user doesn't own: treat it as a possible attack, and report it to security instead of just unlocking.

5. Fix the source, then tell the user

Remove or update the stale password at the source: sign the phone out and back in, clear the saved credential, or update the service. Ask the user to update their devices after a password change, then watch for the lockout to stay away.

6. Record what you found

Note the account, the caller computer name, what was using the old password, and what you changed. If the same machine causes lockouts for several people, that is a problem to pass on.