Windows Event ID 4740 — Account Lockout
Logged on the domain controller when a user account is locked out after exceeding the failed logon threshold.
MITRE ATT&CK
Technique
T1110 · Brute Force
Tactic
Credential Access
Why It Matters
Account lockouts confirm that a credential attack has crossed the volume threshold set by your lockout policy. Multiple accounts locking out in a short window is a near-certain sign of a password spray attack in progress.
Key Fields
Account NameThe account that was locked out
Caller Computer NameThe machine that generated the excessive failed logons
Subject Account NameThe account that triggered the lockout (usually the DC machine account)
Investigation Tips
- 1.Check Caller Computer Name — it identifies the source of the bad password attempts.
- 2.Multiple different accounts locking out from the same Caller Computer Name = password spray.
- 3.Correlate with 4625 on the caller machine to see the failed logon attempts.
- 4.Check if the account is a service account — service accounts lock out when a password is changed without updating the service.
Go deeper: the full Event ID 4740 — Account Lockout guide
Explore the related technique, investigation steps, and evidence to consider alongside this event.
Read the Event ID 4740 — Account Lockout guide →See Event ID 4740 in your logs
Copy the event details as XML and inspect them in your browser. No file upload or hosted analysis is needed.
Decode an event →