![\"\"](\"/images/content/5b6/a479b51ee474b478b457e/742_-138-)
How do you track and resolve a locked Active Directory account? Find out what takes place, how to find specific events, and how to parse events.
\nMany organizations have (or should have) account lockout policies. This policy is a security measure to prevent unauthorized parties from trying to guess the password continuously or brute force a password. Account lockout policies are commonplace in Active Directory and consist of a simple approach to combating a major security issue. Attempt the wrong password a certain number of times, and the account is unusable until an administrator manually re-enables it again. The intention is true, but in some instances, the implementation is not.
\r\nIn some situations, especially when a password is changed, an account can suddenly start getting locked out consistently for no apparent reason. A user calls the help desk, the help desk re-enables the account, and a little bit later, the account is locked out again. It's a frustrating experience for both the user and the help desk. Sometimes the problem is exacerbated by the unknown origin of the lockouts. Somewhere, somehow there's a person, a script, or a process continually trying the same wrong password over and over again, but no one knows where.
\r\nSo how do you track down these annoying lockouts? One way is by using a PowerShell script. But first, let's go over what happens when an account is locked out.
\r\nIn a Windows Server 2008 or later environment, there is a short back and forth between the client system, the client system's domain controller, and the domain controller holding the Primary Domain Controller (PDC) emulator role. This occurs as follows:
\r\nWhere would be the best place to find the source? The answer is at the PDC emulator. The reason for that is because every account lockout is recorded there in the security event log. The PDC emulator is a central place that can be queried for all account lockout events.
\r\nTo query the PDC emulator, we'll use PowerShell's Get-WinEvent cmdlet. This is an extremely useful cmdlet for quickly parsing through one or more event logs on a server. We're looking for an event ID of 4740. First, we need to find the domain controller that holds the PDC emulator role. One way to do this is by using the Get-AdDomain cmdlet.
\r\nOnce we know the PDC emulator, then it's just a matter of querying its security event log for event ID 4740.
\r\nI have an account called abertram that is locked out. Let's see how to track down the culprit.
\r\nWe've got the PDC emulator now, so let's query its security log with a PowerShell script.
\r\n\n\r\n
## Define the username that’s locked out
$Username = ‘abertram’
## Find the domain controller PDCe role
$Pdce = (Get-AdDomain).PDCEmulator
## Build the parameters to pass to Get-WinEvent
$GweParams = @{
‘Computername’ = $Pdce
‘LogName’ = ‘Security’
‘FilterXPath’ = \"*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]\"
}
## Query the security event log
$Events = Get-WinEvent @GweParams
\n
This gives us the lockout event.
\r\nBut we don't have the originating client system yet. To get that, we'll have to dig a little deeper. The actual username is buried in each event's Properties value. To find the username in each event, we can simply use this line.
\r\n\r\n\r\n$Events[0].Properties[0].Value
\r\n
This finds the username in the first event and in the first instance of the Properties value. Luckily, the client system is just in the second instance of Properties.
\r\n\r\n\r\n$Events[0].Properties[1].Value
\r\n
Once you know where the client system name is located, it's just a matter of inserting it into a loop, and we've found the culprit.
\r\nNow you're armed and ready to go the next time the help desk rings you with that incessant AD user account that keeps getting locked out.
\n","docType":"article","guid":"articles_581859afec97ee882c78a058f9e79061","lastModified":"2018-09-05T11:00:00.000Z","published":"2018-09-05T11:00:00.000Z","structuredData":null,"subtitle":"How do you track and resolve a locked Active Directory account? Find out.","template":"v1","title":"How To Resolve Active Directory Account Lockouts With PowerShell","type":"article","author":{"avatar":null,"bio":"Adam Bertram is a 20-year veteran of IT and experienced online business professional. He's an entrepreneur, IT influencer, Microsoft MVP, blogger, trainer and content marketing writer for multiple technology companies. Adam is also the founder of the popular IT career development platform TechSnips. Catch up on Adam's articles at adamtheautomator.com, connect on LinkedIn, or follow him on Twitter at @adbertram or the TechSnips Twitter account at @techsnips_io.","name":"Adam Bertram","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/adambertram/","twitter":"https://twitter.com/adbertram","website":"https://www.adamtheautomator.com/"},"status":"enabled","title":null,"type":"Contributing Writer","user":{"imagePath":"https://staging.business.com/images/undefined","profile":{"company":"eGain Communications","jobTitle":"Product Management Analyst","website":""}}},"breadcrumbs":null,"channels":{"primary":{"name":"Technology","slug":"technology"},"sub":{"name":"Technology Solutions","slug":"technology-solutions"}},"meta":{"robots":"index, follow","description":"How do you track and resolve a locked Active Directory account? Find out what takes place, how to find specific events, and how to parse events.","title":"How to Resolve Active Directory Account Lockouts - business.com"},"parsedContent":{"toc":[{"id":"ad-account-lockout-policies","title":"AD Account Lockout Policies"},{"id":"resolving-a-locked-ad-account","title":"Resolving A Locked AD Account"},{"id":"using-powershell-to-track-down-the-source-of-ad-account-lockouts","title":"Using PowerShell To Track Down The Source Of AD Account Lockouts"}],"json":[{"component":"p","children":["How do you track and resolve a locked Active Directory account? Find out what takes place, how to find specific events, and how to parse events."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":["Active Directory (AD) is a wonderful service. You can log on from anywhere on the network using the same username and password. It couldn't be easier -- that is, until you forget to close a remote desktop session, or a worm spreads across the network, or you forget you're running a scheduled task as your user account, or... Well, you get the point. AD is an extremely useful product; this is why its adoption rate is so high. The problem is when an account begins to lock out for no reason whatsoever. Or so you think."]},{"component":"br"},{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a476792a3a473448b458c/1200_-900- 1200w, /images/content/5b6/a476792a3a473448b458c/668_-501- 668w, /images/content/5b6/a476792a3a473448b458c/320_-240- 320w","sizes":"668px, 100%"}}]}]},{"component":"h2","props":{"id":"ad-account-lockout-policies"},"children":["AD Account Lockout Policies"]},{"component":"p","children":["Many organizations have (or should have) account lockout policies. This policy is a security measure to prevent unauthorized parties from trying to guess the password continuously or brute force a password. Account lockout policies are commonplace in Active Directory and consist of a simple approach to combating a major security issue. Attempt the wrong password a certain number of times, and the account is unusable until an administrator manually re-enables it again. The intention is true, but in some instances, the implementation is not."]},{"component":"p","children":["In some situations, especially when a password is changed, an account can suddenly start getting locked out consistently for no apparent reason. A user calls the help desk, the help desk re-enables the account, and a little bit later, the account is locked out again. It's a frustrating experience for both the user and the help desk. Sometimes the problem is exacerbated by the unknown origin of the lockouts. Somewhere, somehow there's a person, a script, or a process continually trying the same wrong password over and over again, but no one knows where."]},{"component":"p","children":["So how do you track down these annoying lockouts? One way is by using a PowerShell script. But first, let's go over what happens when an account is locked out."]},{"component":"h2","props":{"id":"resolving-a-locked-ad-account"},"children":["Resolving A Locked AD Account"]},{"component":"p","children":["In a Windows Server 2008 or later environment, there is a short back and forth between the client system, the client system's domain controller, and the domain controller holding the Primary Domain Controller (PDC) emulator role. This occurs as follows:"]},{"component":"ol","children":[{"component":"li","children":["Whenever a user account authentication is attempted, the credentials are sent up to the appropriate domain controller for the client system's subnet. "]},{"component":"li","children":["If the password is wrong, the client system's domain controller forwards the request to the domain controller holding the PDC emulator role. This is because the client system's domain controller might not have the most current password, and as a design feature of Active Directory, the domain controller holding the PDC emulator role always will. "]},{"component":"li","children":["The PDC emulator tries the password again, and if it is still found to be wrong, the PDC emulator increments the ",{"component":"strong","children":["badPwdCount"]}," attribute on the user account."]},{"component":"li","children":["An event ID 4740 is generated on the PDC emulator with the client system IP address that initiated the original request and with the user account."]},{"component":"li","children":["The PDC emulator then informs the client system's domain controller that the password is, in fact, wrong."]},{"component":"li","children":["The client system's domain controller then notifies the client system that the password was wrong."]}]},{"component":"p","children":["Where would be the best place to find the source? The answer is at the PDC emulator. The reason for that is because ",{"component":"em","children":["every "]},"account lockout is recorded there in the security event log. The PDC emulator is a central place that can be queried for all account lockout events."]},{"component":"h2","props":{"id":"using-powershell-to-track-down-the-source-of-ad-account-lockouts"},"children":["Using PowerShell To Track Down The Source Of AD Account Lockouts"]},{"component":"p","children":["To query the PDC emulator, we'll use PowerShell's ",{"component":"strong","children":["Get-WinEvent"]}," cmdlet. This is an extremely useful cmdlet for quickly parsing through one or more event logs on a server. We're looking for an event ID of 4740. First, we need to find the domain controller that holds the PDC emulator role. One way to do this is by using the ",{"component":"strong","children":["Get-AdDomain"]}," cmdlet."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a479b51ee474b478b457e/742_-138- 742w, /images/content/5b6/a479b51ee474b478b457e/412_-76- 412w, /images/content/5b6/a479b51ee474b478b457e/206_-38- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5b6/a479b51ee474b478b457e/360-67-","alt":"","width":"360","height":"67","data-content-img-id":"5b6a479b51ee474b478b457e"}}]}]},{"component":"p","children":["Once we know the PDC emulator, then it's just a matter of querying its security event log for event ID 4740."]},{"component":"p","children":["I have an account called abertram that is locked out. Let's see how to track down the culprit."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a47d592a3a473448b458e/1200_-461- 1200w, /images/content/5b6/a47d592a3a473448b458e/668_-257- 668w, /images/content/5b6/a47d592a3a473448b458e/320_-123- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/a47d592a3a473448b458e/678-261-","alt":"","width":"678","height":"261","data-content-img-id":"5b6a47d592a3a473448b458e"}}]}]},{"component":"p","children":["We've got the PDC emulator now, so let's query its security log with a PowerShell script."]},{"component":"blockquote","children":[{"component":"em","children":[{"component":"strong","children":[{"component":"br"},"## Define the username that’s locked out"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["$Username = ‘abertram’",{"component":"br"}]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["## Find the domain controller PDCe role"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["$Pdce = (Get-AdDomain).PDCEmulator",{"component":"br"}]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["## Build the parameters to pass to Get-WinEvent"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["$GweParams = @{"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":[" ‘Computername’ = $Pdce"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":[" ‘LogName’ = ‘Security’"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":[" ‘FilterXPath’ = \"*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Username']]\""]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["}"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":[{"component":"br"},"## Query the security event log"]}]},{"component":"br"},{"component":"em","children":[{"component":"strong","children":["$Events = Get-WinEvent @GweParams",{"component":"br"},{"component":"br"}]}]}]},{"component":"p","children":["This gives us the lockout event."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter full"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a47f951ee47d8748b456e/1200_-142- 1200w, /images/content/5b6/a47f951ee47d8748b456e/668_-79- 668w, /images/content/5b6/a47f951ee47d8748b456e/320_-38- 320w","sizes":"668px, 100%"}},{"component":"img","props":{"src":"/images/content/5b6/a47f951ee47d8748b456e/901-107-","alt":"","width":"901","height":"107","data-content-img-id":"5b6a47f951ee47d8748b456e"}}]}]},{"component":"p","children":["But we don't have the originating client system yet. To get that, we'll have to dig a little deeper. The actual username is buried in each event's Properties value. To find the username in each event, we can simply use this line."]},{"component":"blockquote","children":[{"component":"p","children":[{"component":"em","children":[{"component":"strong","children":["$Events[0].Properties[0].Value"]}]}]}]},{"component":"p","children":["This finds the username in the first event and in the first instance of the Properties value. Luckily, the client system is just in the second instance of Properties."]},{"component":"blockquote","children":[{"component":"p","children":[{"component":"em","children":[{"component":"strong","children":["$Events[0].Properties[1].Value"]}]}]}]},{"component":"p","children":["Once you know where the client system name is located, it's just a matter of inserting it into a loop, and we've found the culprit."]},{"component":"p","children":[{"component":"picture","props":{"className":"aligncenter med"},"children":[{"component":"source","props":{"srcSet":"/images/content/5b6/a480c1039eb277d8b45d7/742_-52- 742w, /images/content/5b6/a480c1039eb277d8b45d7/412_-29- 412w, /images/content/5b6/a480c1039eb277d8b45d7/206_-14- 206w","sizes":"(min-width: 870px) 412px, (min-width: 400px) 38vw, 62%"}},{"component":"img","props":{"src":"/images/content/5b6/a480c1039eb277d8b45d7/507-36-","alt":"","width":"507","height":"36","data-content-img-id":"5b6a480c1039eb277d8b45d7"}}]}]},{"component":"p","children":["Now you're armed and ready to go the next time the help desk rings you with that incessant AD user account that keeps getting locked out."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5cf/894749c658a6a5a8b457e/1500-0-","caption":"Vitalii Vlasov/Shutterstock","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"PowerShell: Everything You Need to Know","canonical":"https://www.business.com/articles/powershell-everything-you-need-to-know/","slug":"powershell-everything-you-need-to-know","thumbnail":"https://www.business.com/images/content/5b8/998581039eb8f738b457b/1500-0-","dek":"What you need to know to unlock Microsoft PowerShell's full capabilities.","lastModified":"2018-09-05T17:00:00Z","published":"2018-09-05T17:00:00Z","sponsored":false},{"title":"From COVID-19 to Hurricane Season: Disaster Preparedness for Small Business","canonical":"https://www.business.com/articles/business-disaster-prep/","slug":"business-disaster-prep","thumbnail":"https://www.business.com/images/content/5e7/a495e5a215eb11d8b4569/1500-0-","dek":"Natural disasters – whether a hurricane, tornado or outbreak like COVID-19 – can have a disastrous effect on small businesses, but they don't have to. Here's how to weather a disaster successfully.","lastModified":"2020-03-25T15:19:00Z","published":"2018-09-26T07:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Managing Active Directory","canonical":"https://www.business.com/articles/powershell-active-directory-cmdlets/","slug":"powershell-active-directory-cmdlets","thumbnail":"https://www.business.com/images/content/5cf/90cab7b4374ab068b456f/1500-0-","dek":"Administering Active Directory is one of the most critical roles in any Windows network.","lastModified":"2018-09-04T08:00:00Z","published":"2018-09-04T08:00:00Z","sponsored":false},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"Essential PowerShell Cmdlets For Auditing And Maintaining Storage","canonical":"https://www.business.com/articles/powershell-for-storage/","slug":"powershell-for-storage","thumbnail":"https://www.business.com/images/content/5d0/18e065a215ea2498b4588/1500-0-","dek":"PowerShell v5 offers some new features for managing storage.","lastModified":"2018-09-04T11:00:00Z","published":"2018-09-04T11:00:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay - 08-05","canonical":"https://staging.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://staging.business.com/images/content/5c5/afd7f54d26d67178b458d/1500-0-","dek":"Edit 07-24 - subtitle","lastModified":"2019-08-05T20:58:00Z","published":"2018-06-21T16:05:00Z","sponsored":null},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay","canonical":"https://www.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://www.business.com/images/content/5c5/e0a269c658a457c8b4591/1500-0-","dek":"You no longer need to carry a bulky wallet filled with numerous credit cards or cash.","lastModified":"2018-06-21T16:06:00Z","published":"2018-06-21T16:05:00Z","sponsored":false},{"title":"Your Guide to Creating a Small Business Marketing Plan","canonical":"https://www.business.com/articles/sample-marketing-plan-outline-and-template/","slug":"sample-marketing-plan-outline-and-template","thumbnail":"https://www.business.com/images/content/5f3/3e1765a215eb62d8b4567/1500-0-","dek":"Follow these templates and guidelines to get started on creating your business's marketing plan.","lastModified":"2020-08-12T12:28:00Z","published":"2018-03-02T13:00:00Z","sponsored":false},{"title":"Microsoft Azure vs. Amazon Web Services: Cloud Comparison","canonical":"https://www.business.com/articles/azure-vs-aws-cloud-comparison/","slug":"azure-vs-aws-cloud-comparison","thumbnail":"https://www.business.com/images/content/5cf/ff3445a215ed86a8b459d/1500-0-","dek":"Which one is right for your business?","lastModified":"2018-05-25T07:00:00Z","published":"2018-05-25T07:00:00Z","sponsored":false},{"title":"How and When to Create and Use PowerShell Modules","canonical":"https://www.business.com/articles/powershell-modules/","slug":"powershell-modules","thumbnail":"https://www.business.com/images/content/5cf/a71415a215e501f8b457a/1500-0-","dek":"Step-by-step instructions on creating and using modules.","lastModified":"2018-09-05T08:00:00Z","published":"2018-09-05T08:00:00Z","sponsored":false},{"title":"How to Hire for Your Business","canonical":"https://www.business.com/articles/how-to-staff-business/","slug":"how-to-staff-business","thumbnail":"https://www.business.com/images/content/5ea/9c8bb9c658aee018b456c/1500-0-","dek":"Sterling Staffing Solutions CEO Stephen Carter shares his tips on staffing your business.","lastModified":"2020-07-31T15:00:00Z","published":"2018-08-16T12:00:00Z","sponsored":false},{"title":"What's in a Name? How to Choose the Most Appropriate Job Title","canonical":"https://www.business.com/articles/how-to-pick-startup-job-title/","slug":"how-to-pick-startup-job-title","thumbnail":"https://www.business.com/images/content/5d0/1c13c9c658aa4558b4583/1500-0-","dek":"Business experts gave us these five tips for naming roles in your startup or SMB.","lastModified":"2018-06-01T12:50:00Z","published":"2018-06-01T12:50:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df3d8695a215e58428b4570/POS_GETTY_DERO2084.jpg","canonical":"https://staging.business.com/categories/best-pos-systems/","title":"The Best POS Systems of 2021","dek":"Before you choose a POS system, check out our reviews of the best picks for 2021. ","slug":"best-pos-systems","lastModified":"2021-03-17T17:33:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00d4787b43745d6a8b456e/Laptop_undrey_getty.jpg","canonical":"https://staging.business.com/categories/employee-monitoring-software/","title":"The Best Employee Monitoring Software of 2021","dek":"We've narrowed down the best employee monitoring software for businesses. Check out our best picks and reviews.","slug":"employee-monitoring-software","lastModified":"2021-03-05T15:40:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2018-09-05T11:00:00.000Z","template":"v1","title":"How To Resolve Active Directory Account Lockouts With PowerShell","meta":{"robots":"index, follow"},"docType":"articles","slug":"powershell-active-directory-lockouts","canonical":"https://staging.business.com/articles/powershell-active-directory-lockouts/","skipTOC":false}},"staticQueryHashes":[]}![\"\"](\"/images/content/5b6/a47d592a3a473448b458e/1200_-461-)
![\"\"](\"/images/content/5b6/a47f951ee47d8748b456e/1200_-142-)
![\"\"](\"/images/content/5b6/a480c1039eb277d8b45d7/742_-52-)