Troubleshooting AD lockouts with Event viewer

You can easily see when a user has been locked out of AD using Event Viewer.

To do so open Event Viewer and expand Security, Filter the log for Event ID 4740.

Displayed will be all the locked out users with the time, username and device that the lockout has come from.

If you found this article helpful, would you consider buying me a Coffee?