TransWikia.com

AD Account are being locked but only some are showing as 4740 in Domain controller

Super User Asked by Honk on December 1, 2021

We have been seeing increasing number of AD Account lockouts.

Some of these lockouts show up in event viewer as 4740 events but most do not show up at all. My account has been locked out almost once a day, there is never a 4740 event associated with it. However, if I try to login in with a bad password eg:BadPwd123 till my account is locked out, I see the 4740 in eventviewer.

Are there other event lockouts other than 4740 That I can be searching for?

I have already enabled

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies-> 

enter image description here

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP