Table of Contents

Account Lockout Reports

Account Lockout Reporting is the process of scanning Active Directory for currently locked out Windows accounts, scanning Windows machines for locally locked out accounts and scanning Windows Security Event Logs for Event ID 4740 (A user account was locked out.) and 4767 (A user account was unlocked.), then finally reporting the results in Corner Bowl Server Manager, through email or by saving to a file such as a CSV, HTML or PDF file.

Account Lockout Report Tutorial on youtube

Sever Manager includes two different account lockout reports.

TypeDescription
Security Event Log Account Lockout Report

Scans multiple Domain Controller Security Event Logs for domain account lockout history event IDs 4740 and 4767 and, optionally, scans multiple stand-alone Windows Security Event Logs for non-domain local account lockout history.

This report is typically used for auditing and compliance.

Account Lockout Report (Active Directory/WMI)

Scans Active Directory Windows Domains for currently locked out domain accounts and, optionally, scans multiple Windows machines for currently locked out non-domain local accounts.

LDAP is used to scan Active Directory Windows Domains and WMI is used to scan Windows machines.

This report is typically used for real-time troubleshooting and network administration.

Security Event Log Account Lockout Report

Server Manager includes a sample report that scans the Security Event Logs in the Centralized Log Database for lockout history event IDs 4740 and 4767.

Alert Event Log Consolidation must be enabled for each target domain controller and stand-alone server.

The Columns Tab

Use the Columns Tab to enable and disable specific columns from the report as well as set the column order, sort order, and grouping options. For more information see: Report Columns

Account Lockout Report Column Definitions View
Account Lockout Report Column Definitions View

The Options Tab

TypeDescription
Show account lockout history Shows all 4740s then overlays corresponding 4767 events to show the total number of times an account has been locked out and how many times an administrator has unlocked the account.
Alert Windows only logs 4767 account unlock events when an Administrator manually unlocks an account. Windows does not log a 4767 account unlock event each time an account is automatically unlocked.
Alert When this option is selected, the last administrator to unlock the account is listed.
Show account lockouts not manually unlocked Hides all 4740 Events that have a corresponding 4767 Event.

Account Lockout Report (Active Directory/WMI)

Server Manager includes a sample report that scans Active Directory and stand-alone servers for accounts currently locked.

  • From the Explorer View, navigate to Reports | Sample Reports | Event Logs | Security Reports | Account Lockout, right click on Account Lockout Report (Active Directory/WMI) then select Properties. The Properties View displays.
  • The Properties View contains 4 configuration tabs.

The Options Tab

  • Use the Scan Active Directory for locked out domain accounts check box to scan Active Directory then use the Directory Service drop-down to select the domain to monitor.
  • Use the Scan assigned machines for locked out local accounts check box to scan stand-alone servers for locked out non-domain local accounts.
Account Lockout Report Properties View
Account Lockout Report Properties View

Host Assignment

  • Use the Assignments View to assign each target host and host group.
    Alert Only assign stand-alone servers to this report if you are generating a report of non-domain account lockouts. Do not assign any hosts if you are only monitoring domain accounts.

Related Topics

Event Log Consolidation Template