This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 0%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDB%3C/text%3E%3C/svg%3E)
Some of our user accounts are getting frequently locked out. Event 4740 doesn't show the source Computer name. I have enabled netlogon logs and it doesn't show it either. Please help. Please find screenshot below: -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 80%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
Did you check if there is a event ID 4771 as mentioned below :
I invite you to take a look at this article , he descript many ways to identify the source of lockout:
How to Find the Source of Account Lockouts in Active Directory
Please don't forget to accept helpful answer
Thanks for your response. Event ID 4771 is for Kerberos authentication. As you can see in the Netlogon screenshot, it is using NTLM. I will look at this article too.
The article did help some way. I found that the user for who the source workstation is missing. The netlogon log shows that the connection is coming via NPS server, but still the source of the computer is missing
@Danish Mehmood Batliwala
Try to check if there is any NTLM eventID 4625 :
Please don't forget to accept helpful answer
Workstation name is still empty. However, the netlogon does show that the credentials are entered via NPS server. It seems to be the user credentials is cached for the wifi connectivity and and causing the issue but it still doesnt show the workstation from where it is really coming
Agree with you it seems comming from wifi using NPS to authenticate user to connect him on network.
In this case you cannot find this information in AD , because AD can see only NPS which tried to authenticate user. you should check NPS log , may be you find any trace of user authentication.
Please don't forget to accept helpful answer
Indeed. I checked on NPS as a first thing. However, I could not find the source even on the NPS server. the NTLM logs doesnt have the workstation name
If the authentication is not sent by the source directly, I think you cannot find the source IP on active directory and you should check on network device if there is any cache credential or trace of user authentication.
Please don't forget to close this thread by accepting helpful answer
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
If the Answer is helpful, please click "Accept Answer" and upvote it.
Thanks for your reply. The netlogon screenshot is from PDC. the log that shows (via) is nothing but another domain controller and when I checked the netlogon log on the mentioned domain controller then it points me to the NPS server and there's the dead end. Both NTLM logs and event id 4625 on NPS server doesn't show the source computer name
