Quick Guide — How to Troubleshoot Active Directory Account Lockouts

Active Directory account lockouts can be hugely problematic for
organizations. There have been documented instances of attackers
leveraging the account lockout feature in a type of denial of
service attack. By intentionally entering numerous bad passwords,
attackers can theoretically lock all of the users out of their
accounts.

But what do you do if you are experiencing problems with account
lockouts?

The Windows operating system is somewhat limited in its ability
to troubleshoot account lockouts, but there are some things that
you can do. For example, you can use Windows PowerShell to
determine which accounts have been locked out. The command for
doing so is:

Incidentally, the UsersOnly parameter prevents computer objects
from being included in the results, while the Select-Object command
filters the results list to display only the user’s name and their
account name.

If you find that accounts have been locked out, then there are a
couple of ways of unlocking them. You can unlock accounts one at a
time by using this command:

If, on the other hand, you need to unlock user accounts in bulk,
then you can do so with this command:

While it is undeniably important to be able to unlock user
accounts, it is equally important to be able to find out why
accounts were locked out in the first place. You can gain a little
bit of insight into the problem by using a variation of the
Search-ADAccount command that you saw a moment ago:

This command will display additional information about all of
the accounts that have been locked out. You can use this
information to find out when the user last logged on and whether
the user’s password is expired. Because this command can return a
lot of data, you may find it helpful to write the results to a CSV
file. Here is an example of how to do so:

It is possible to go further with Active Directory lockout
troubleshooting using the native Windows tools, but in order to do
so, you’re going to need to make a change to your group policy
settings prior to lockouts occurring. Oddly enough, account
lockouts are not logged by default.

You can enable logging by opening the Group Policy Editor and
navigating through the console tree to Computer Configuration |
Windows Settings | Security Settings | Advanced Audit Policy
Configuration | System Audit Policies | Account Management. Now,
enable both success and failure auditing for user account
management.

Once the new group policy setting has been applied across the
domain, it will cause event number 4740 to be written to the
Security event log any time that an account becomes locked out.

There is a good chance that this command will produce an
overwhelming number of results. You can use the Select-Object
cmdlet to limit the number of results shown. If, for instance, you
only want to see the ten most recent results, you could use this
command:

Notice that I also included references to UserID and Message in
the Select-Object cmdlet. The UserID will cause the username to be
displayed, and the reference to Message will cause PowerShell to
display detailed information about the event. Perhaps the most
useful item displayed in the message is the Caller Computer Name,
which reflects the name of the machine that caused the user account
to be locked out. If necessary, you can also use the TimeCreated
property to find out when the lockout occurred.

The command shown above can sometimes cut off the Message. If
this happens to you, you can get around this problem by appending
the Format-List command, as shown below:

As you can see, Windows is limited in its ability to help you to
troubleshoot account lockout problems. If you are consistently
experiencing account lockout issues and need additional
troubleshooting capabilities or if you, like many other
organizations, are experiencing an increase in account lockout
related calls during the global pandemic, then you might consider
checking out some of the third-party tools that are available such
as a self-service password reset
solution^[1].

Identifying what is driving lockouts and rectifying the issue is
one part of the equation. To address the issue holistically, IT
departments need to provide users with the ability to unlock their
own accounts securely, anytime, anywhere.