Troubleshooting account lockouts in Active Directory

In this video, I'll talk about how you can troubleshoot account lockout issues in Active Directory and find the source of account lockouts such as computers, programs or other types of devices.

I'll show you how can use Security Logs in Event Viewer to view the lockout events, enable additional audit policies on default domain controller policy, debug using Netloggin logging, Powershell Script Account Lockout Status (GUI tool) to find the source of account lockouts.

Table of Contents:

00:00 - Intro
00:25 - Understanding Account Lockout Policy in AD
04:00 - How to check if user accounts are locked in AD?
06:20 - Unlock User Accounts in AD
07:17 - Troubleshooting account lockout events using Event Viewer
12:21 - Extend the size of security log in Event Viewer
13:32 - Find unknown computer/device in Security Events (Event ID 4770)
17:04 - Event ID 4625 | NTLM Authentiction
18:30 - Using NetLogon debugging
20:06 - Using PowserShell Script on PDC Emulator to find the source of account lockouts
21:09 - Using PowerShell script on all domain controller to find the source of account lockouts
21:26 - Using Account Lockout Status to find the source of account lockouts
23:17 - Troubleshoot using Process Tracking to find the process locking the user accounts.

The below PS script finds the events with an Event ID 4740 and returns the lockout time and the name of the computer from which it occurred:

$Usr = ‘Michael.Greene’
$Pdc = (Get-AdDomain).PDCEmulator
$ParamsEvn = @{
‘Computername’ = $Pdc
‘LogName’ = ‘Security’
‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Usr']]"
}
$Evnts = Get-WinEvent @ParamsEvn
$Evnts | foreach {$_.Properties[1].value + ' ' + $_.TimeCreated}

If you want to search all domain controllers, then you can use the below script in PowerShell.

$Usr = ‘username1’
Get-ADDomainController -fi * | select -exp hostname | % {
$ParamsEvn = @{
‘Computername’ = $Pdc
‘LogName’ = ‘Security’
‘FilterXPath’ = "*[System[EventID=4740] and EventData[Data[@Name='TargetUserName']='$Usr']]"
}
$Evnts = Get-WinEvent @ParamsEvn
$Evnts | foreach {$_.Computer + " " +$_.Properties[1].value + ' ' + $_.TimeCreated}
}

Download Account Lockout Status - https://www.microsoft.com/en-in/downl...