Windows Event ID 4767 – Microsoft-Windows-Security-Auditing: User Account Unlocked

Start by examining the specific details of the Event ID 4767 entry to understand the context of the account unlock operation.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter the log for Event ID 4767 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4767 in the Event IDs field and click OK
5. Double-click on a 4767 event to view detailed information
6. Review the Subject section to identify who performed the unlock
7. Check the Target Account section to see which account was unlocked
8. Note the Workstation Name to identify the source of the unlock operation

Use this PowerShell command to quickly retrieve recent unlock events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4767} -MaxEvents 50 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

Investigate the relationship between unlock events and preceding lockout events to understand the full account management timeline.

1. Search for corresponding Event ID 4740 (Account Locked Out) entries that preceded the unlock
2. Use PowerShell to correlate lockout and unlock events for specific accounts:

# Get lockout and unlock events for analysis
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740,4767} -MaxEvents 100
$Events | Sort-Object TimeCreated | Format-Table TimeCreated, Id, @{Name='Account';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Account Name:*'}).Split(':')[1].Trim()}} -AutoSize

3. Review the time intervals between lockout and unlock events
4. Check if unlocks align with your organization's lockout duration policy
5. Identify patterns of repeated lockout/unlock cycles for the same accounts
6. Cross-reference with Event ID 4625 (Failed Logon) to understand lockout causes

Examine who is performing unlock operations and from which systems to validate legitimate administrative activity.

1. Extract administrator information from unlock events using PowerShell:

# Analyze who is unlocking accounts
$UnlockEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4767} -MaxEvents 100
$UnlockEvents | ForEach-Object {
    $Event = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        UnlockedBy = $Event.Event.EventData.Data[1].'#text'
        UnlockedAccount = $Event.Event.EventData.Data[5].'#text'
        WorkstationName = $Event.Event.EventData.Data[7].'#text'
    }
} | Format-Table -AutoSize

2. Verify that unlock operations are performed by authorized administrators
3. Check if unlocks originate from expected administrative workstations
4. Review unlock timing to ensure they occur during business hours
5. Cross-reference with change management records for scheduled maintenance
6. Investigate any unlocks performed by service accounts or system processes

Establish baseline monitoring for account unlock patterns to identify anomalies and potential security issues.

1. Create a PowerShell script to track unlock frequency by account:

# Monitor unlock patterns over time
$StartDate = (Get-Date).AddDays(-30)
$UnlockEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4767; StartTime=$StartDate}

$UnlockStats = $UnlockEvents | ForEach-Object {
    $Event = [xml]$_.ToXml()
    [PSCustomObject]@{
        Date = $_.TimeCreated.Date
        Account = $Event.Event.EventData.Data[5].'#text'
        UnlockedBy = $Event.Event.EventData.Data[1].'#text'
    }
} | Group-Object Account | Select-Object Name, Count, @{Name='LastUnlock';Expression={($_.Group | Sort-Object Date -Descending)[0].Date}}

$UnlockStats | Sort-Object Count -Descending | Format-Table -AutoSize

2. Set up automated alerts for accounts with excessive unlock frequency
3. Monitor for unlocks occurring outside business hours
4. Track unlock operations performed by non-administrative accounts
5. Establish thresholds for normal vs. suspicious unlock activity
6. Create reports for security team review and compliance auditing

Perform comprehensive forensic analysis when unlock events indicate potential security incidents or policy violations.

1. Export detailed unlock event data for forensic analysis:

# Export comprehensive unlock event data
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4767} -MaxEvents 1000
$DetailedEvents = $Events | ForEach-Object {
    $Event = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        EventRecordID = $_.RecordId
        SubjectUserSid = $Event.Event.EventData.Data[0].'#text'
        SubjectUserName = $Event.Event.EventData.Data[1].'#text'
        SubjectDomainName = $Event.Event.EventData.Data[2].'#text'
        SubjectLogonId = $Event.Event.EventData.Data[3].'#text'
        TargetUserSid = $Event.Event.EventData.Data[4].'#text'
        TargetUserName = $Event.Event.EventData.Data[5].'#text'
        TargetDomainName = $Event.Event.EventData.Data[6].'#text'
        WorkstationName = $Event.Event.EventData.Data[7].'#text'
    }
}

$DetailedEvents | Export-Csv -Path "C:\Temp\UnlockEvents_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

2. Correlate unlock events with other security events (4624, 4625, 4648)
3. Review Active Directory replication logs if dealing with domain accounts
4. Check for corresponding events on other domain controllers
5. Analyze network traffic logs for the timeframe of suspicious unlocks
6. Document findings for incident response and compliance reporting
7. Implement additional monitoring controls based on investigation results