Event ID: 4740A user account was locked out
A user account was locked out. Subject: Security ID: %4 Account Name: %5 Account Domain: %6 Logon ID: %7 Account That Was Locked Out: Security ID: %3 Account Name: %1 Additional Information: Caller Computer Name: %2
This event generates every time a user account is locked out.
For user accounts, this event generates on domain controllers, member servers, and workstations.
ISO 27001:2013 A.9.2.1
NIST 800-171: 3.1.8
NIST SP 800-53: AC-7
CMMC v2 L2: AC.L2-3.1.8
Lookup Audit Policy Configuration Settings
C:\> AuditPol.exe /get /subcategory:"User Account Management"
LEFT/RIGHT arrow keys for navigationBack to List