Windows Event ID 4705 – Microsoft-Windows-Security-Auditing: User Account Locked Out

Navigate to Event Viewer → Windows Logs → Security to examine the lockout event details.

1. Open Event Viewer by pressing Windows + R, type eventvwr.msc, and press Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4705 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4705 in the Event IDs field and click OK
5. Double-click the event to view details including:
• Account Name: The locked user account
• Account Domain: The domain or computer name
• Caller Computer Name: System that triggered the lockout
• Caller Computer Account: Account used for the authentication attempts
6. Note the timestamp to correlate with other security events

Use PowerShell to query multiple lockout events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4705} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Unlock the affected user account and reset the lockout counter using Active Directory tools or PowerShell commands.

1. For domain accounts, open Active Directory Users and Computers
2. Navigate to the user account and right-click to select Properties
3. Go to the Account tab and check Unlock account if available
4. Click OK to apply changes

Use PowerShell to unlock domain accounts:

# Unlock specific user account
Unlock-ADAccount -Identity "username"

# Check account lockout status
Get-ADUser -Identity "username" -Properties LockedOut, AccountLockoutTime | Select-Object Name, LockedOut, AccountLockoutTime

# Find all locked accounts in domain
Search-ADAccount -LockedOut | Select-Object Name, DistinguishedName

For local accounts, use the Local Users and Groups console:

1. Open Computer Management → Local Users and Groups → Users
2. Right-click the locked account and select Properties
3. Uncheck Account is locked out on the General tab

Use advanced PowerShell queries to identify the source and pattern of account lockouts across multiple domain controllers.

# Query all domain controllers for lockout events
$DCs = Get-ADDomainController -Filter *
$LockoutEvents = @()

foreach ($DC in $DCs) {
    $Events = Get-WinEvent -ComputerName $DC.HostName -FilterHashtable @{
        LogName = 'Security'
        Id = 4705
        StartTime = (Get-Date).AddHours(-24)
    } -ErrorAction SilentlyContinue
    
    $LockoutEvents += $Events | ForEach-Object {
        [PSCustomObject]@{
            TimeCreated = $_.TimeCreated
            DomainController = $DC.HostName
            AccountName = ($_.Message -split '\n' | Where-Object {$_ -match 'Account Name:'} | ForEach-Object {$_.Split(':')[1].Trim()})
            CallerComputer = ($_.Message -split '\n' | Where-Object {$_ -match 'Caller Computer Name:'} | ForEach-Object {$_.Split(':')[1].Trim()})
        }
    }
}

# Display results sorted by time
$LockoutEvents | Sort-Object TimeCreated -Descending | Format-Table -AutoSize

Identify lockout patterns and potential attack sources:

# Group lockouts by caller computer to identify attack sources
$LockoutEvents | Group-Object CallerComputer | Sort-Object Count -Descending | Select-Object Name, Count

# Find accounts with multiple lockouts
$LockoutEvents | Group-Object AccountName | Where-Object {$_.Count -gt 1} | Select-Object Name, Count

Review and adjust account lockout policy settings to balance security with usability requirements.

1. Open Group Policy Management Console for domain policies
2. Navigate to Default Domain Policy → Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy
3. Configure the following settings:
• Account lockout threshold: Number of failed attempts (recommended: 5-10)
• Account lockout duration: How long account stays locked (recommended: 15-30 minutes)
• Reset account lockout counter after: Time window for counting failures (recommended: 15-30 minutes)

Use PowerShell to check current lockout policy:

# Check domain account lockout policy
Get-ADDefaultDomainPasswordPolicy | Select-Object LockoutThreshold, LockoutDuration, LockoutObservationWindow

# Check fine-grained password policy if applicable
Get-ADFineGrainedPasswordPolicy -Filter * | Select-Object Name, LockoutThreshold, LockoutDuration

For local computer policy, use Local Security Policy:

1. Run secpol.msc as administrator
2. Navigate to Account Policies → Account Lockout Policy
3. Configure lockout threshold, duration, and reset counter settings

Set up comprehensive monitoring and automated alerting for account lockout events to enable rapid incident response.

Create a PowerShell script for continuous monitoring:

# Account Lockout Monitor Script
param(
    [int]$ThresholdMinutes = 60,
    [int]$MaxLockouts = 5,
    [string]$EmailTo = "admin@company.com",
    [string]$SMTPServer = "mail.company.com"
)

$StartTime = (Get-Date).AddMinutes(-$ThresholdMinutes)
$LockoutEvents = Get-WinEvent -FilterHashtable @{
    LogName = 'Security'
    Id = 4705
    StartTime = $StartTime
} -ErrorAction SilentlyContinue

if ($LockoutEvents.Count -ge $MaxLockouts) {
    $AlertMessage = @"
Multiple account lockouts detected:
Time Range: $StartTime to $(Get-Date)
Total Lockouts: $($LockoutEvents.Count)

Recent Events:
$($LockoutEvents | Select-Object -First 10 | Format-Table TimeCreated, Message -AutoSize | Out-String)
"@
    
    Send-MailMessage -To $EmailTo -From "lockout-monitor@company.com" -Subject "Account Lockout Alert" -Body $AlertMessage -SmTPServer $SMTPServer
}

Configure Windows Event Forwarding for centralized monitoring:

1. On the collector server, run wecutil qc to configure Windows Event Collector
2. Create a subscription configuration file:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>AccountLockouts</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Account Lockout Events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <Query>
        <![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="Security">*[System[EventID=4705]]</Select>
            </Query>
        </QueryList>
        ]]>
    </Query>
</Subscription>

Import the subscription:

wecutil cs AccountLockouts.xml