Event ID 4740: A user account was locked out
Written when an account passes the lockout threshold of failed logons. On a domain, it is written on the domain controller that holds the PDC emulator role.
- Log
- Security
- Category
- Account management
Why it matters
- The Caller Computer Name says where the bad passwords came from: often a phone or old saved credential, sometimes an attacker.
- Several accounts locked out at once points to password spraying or brute force.
What to check
Check Caller Computer Name, then the 4625 or 4771 failures that led up to the lockout.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.
MITRE ATT&CK
- T1110 Brute Force