Event ID 4767: A user account was unlocked
Written when a locked-out account is unlocked by an administrator.
- Log
- Security
- Category
- Account management
Why it matters
- An unlock straight after a lockout caused by an attacker can let the attack continue.
What to check
Check who unlocked it and whether the cause of the lockout was understood first.
How to turn it on
Advanced Audit Policy: Account Management > Audit User Account Management.