Account Lockout

From AlphaBook
Jump to: navigation, search

Enable lockout policy (disabled be default)

  • Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy

Check if account is locked

  • net user /domain user01

Unlock account

  • Unlock-ADAccount -Identity user01
  • Or check in Active Directory Administrative Center

Delegate helpdesk group unlock permission

  • Apply onto: User objects
  • Allow Read lockoutTime and Write lockoutTime
  • Apply these permission to objects and/or containers within this container only

Check where (on which system) account is locked (from PDC)

  • Get-EventLog -LogName "Security" | where {$_.EventID -eq 4740}
  • Or create a Custom View of the Security Log

Check detailed reason (from the specific system)

  • Check the Security log during the specific time

Event ID 4740

  • A user account was locked out
  • Account Name:
  • Called Computer Name:
  • Task Catagory:User Account Management

Event ID 4740 is missing

  • Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policies\Account Management\Audit User Account Management