Skip to content
Dev0 Docs

Accout Lockout Event Ids

When an Active Directory user account is locked, an account lockout event ID is added to the Windows event logs. Event ID 4740 is added on domain controllers and the event 4625 is added to client computers.

Terminal window
Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    ID = 4740
}