The event has all the information about the user account that was locked out, the time of the lockout, and the source of the failed login attempts (caller computer name). In this guide, we will discuss all the reasons for the event ID 4740 and how to find the source of account lockouts.

What causes Event ID 4740, a user account might be locked out?

There are various reasons for the event to be generated. Some of the popular ones are mentioned here:

Too many failed login attempts – If a user inputs an incorrect password several times, their account may be locked out to stop further attempts. Password expiration – The account may be locked out if a user’s password has expired until they reset their password. Group Policy settings – Your organization may have set Group Policy settings that lock out the user accounts after a specific number of failed login attempts or after a particular time.

What can I do to determine the source of the Event ID 4740 account lockout?

1. Enable Auditing for event 4740

2. Use PowerShell to find the PDC emulator role 

3. Use Event Viewer

Click on the Search icon, type Event Viewer, and click Open. On the left pane, go to Windows Logs, then click Security. From the right pane, select Filter Current Log. Search 4740 and click OK. You will get a list of events Click on the event and check out the details of the source.

4. Use the Microsoft Lockout Status tool

5. Use a third-party tool

Using a free Active Directory troubleshooting tool like NetTools helps to troubleshoot, update queries, and report Active Directory and other Lightweight Directory Access Protocol directories. It is a portable executable file that allows you to view and troubleshoot Active Directory permissions.  SPONSORED NetTools searches the event logs to locate events relevant to the account on the selected domain controller. Also, it can find the event logs of any member servers in the authentication chain and can display the information related to the reason for the lockout. To know the source, follow these steps:  So, these are the easiest ways to find out the source of account lockout event ID 4740. Once you get the source, you can easily take steps to prevent it from happening. Have you already tried some of these solutions? Or maybe you know of other methods to solve this Windows event ID? Feel free to share your expertise with us via the comments section below.

SPONSORED Name * Email * Commenting as . Not you? Save information for future comments
Comment

Δ