This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 13%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Hi All
I'm battling with an account that locks out every afternoon.
I've turned on event user account logging to receive event ID 4740 and 4767.
I run a PowerShell command and get the 'Caller Computer Name' & the 'LockoutSource' for other locked out accounts, but it's missing for this particular account. Is there another way (PowerShell or other tool) I can work out what is repeatedly causing these daily lockouts?
Have you checked the security logs on the user's device? Do they use any type of third party apps to connect to their account? Do you use corporate WiFi where they use their credentials? If so, have them delete the profile and see if the problem persists.
The user account is an admin account and doesn’t have a device associated with it.
The only 3rd party app is mremote.
No corp Wi-Fi used.
I’ll see if Mremote has any logs to check.
Hi @tech_tc
Have look at this article it might help identify why the account is being locked.
https://nettools.net/troubleshoot-account-lockouts/
Gary.
Hi GaryReynolds
I gave nettools a try, but got some unexpected results that did not make much sense to me.
It show several accounts as being locked, but the were not locked when check on the DC.
Also the account in question that was locked still did not show the lockout source.
Can you share a screenshot of the test that you are running?
Gary.
I'm literally just running the 'Locked Accounts' option. It returns 4 users which are not actually locked. (i'm unable to share a screenshot of the users, sorry)
The account im working on is not locked out at present.
The accounts listed in the Lock Accounts test have the Lockout Time attribute set, which means the account is currently locked. If you right click on a user and select Last Logon option it will test the account against each DC in the environment.
Gary.
The account shows as locked in the nettools application for all dc's, but can't understand why there is no message saying 'User account is locked' etc when viewing the AD Users and Computers mmc.
Look at the attributes tab and check the value of the lockouttime attribute and see if there is a value set?
yes, it has a value
Hi Gary Reynolds
The actual problem account has locked out gain.
I can run powershell
Get-WinEvent -FilterHashtable @{logname=’security’; id=4740} | fl
It shows the account but not the 'Caller Computer Name'.
Where do i check on the nettools app to see the account lockout source?
If the lockouttime attribute has value this means the account is locked out:
The date and time (UTC) that this account was locked out. This value is stored as a large integer that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC). A value of zero means that the account is not currently locked out.
https://learn.microsoft.com/en-us/windows/win32/adschema/a-lockouttime
From the Last Logon test in NetTools, check the account that is locked, then right click on the PDC and select the Display Event Details option from the context menu.
If you want to use another method to do the same thing have a look at this article http://woshub.com/troubleshooting-identify-source-of-active-directory-account-lockouts/
Gary