Windows Event ID 4944 – Microsoft-Windows-Security-Auditing: An account was locked out

First, verify the current lockout status and unlock the account if necessary:

# Check account lockout status
Get-ADUser -Identity "username" -Properties LockedOut, AccountLockoutTime, BadLogonCount

# Unlock the account
Unlock-ADAccount -Identity "username"

# Verify unlock was successful
Get-ADUser -Identity "username" -Properties LockedOut

Navigate to Event Viewer → Windows Logs → Security and filter for Event ID 4944 to see the lockout details. Check the event properties for the source computer name and timestamp to identify where the failed attempts originated.

For local accounts on standalone systems:

# Check local account status
Get-LocalUser -Name "username" | Select-Object Name, Enabled, AccountExpires, PasswordExpired

# Enable locked local account
Enable-LocalUser -Name "username"

Investigate the failed logon attempts that led to the account lockout:

# Get recent failed logon events (4625) for the locked account
$Events = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4625
    StartTime=(Get-Date).AddHours(-24)
} | Where-Object {$_.Message -like "*username*"}

# Display detailed information
$Events | ForEach-Object {
    $Event = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        SourceIP = $Event.Event.EventData.Data[19].'#text'
        WorkstationName = $Event.Event.EventData.Data[13].'#text'
        FailureReason = $Event.Event.EventData.Data[8].'#text'
        LogonType = $Event.Event.EventData.Data[10].'#text'
    }
} | Format-Table -AutoSize

Check for patterns in source IPs and workstation names to identify potential attack sources:

# Group failed attempts by source IP
$Events | Group-Object {([xml]$_.ToXml()).Event.EventData.Data[19].'#text'} | 
Sort-Object Count -Descending | Select-Object Name, Count

Examine the current account lockout policy settings that triggered the lockout:

# Check domain account lockout policy
Get-ADDefaultDomainPasswordPolicy | Select-Object LockoutDuration, LockoutObservationWindow, LockoutThreshold

# For fine-grained password policies
Get-ADFineGrainedPasswordPolicy -Filter * | Select-Object Name, LockoutDuration, LockoutThreshold, LockoutObservationWindow

Access Group Policy Management Console and navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy to review:

• Account lockout threshold (number of failed attempts)
• Account lockout duration (how long accounts stay locked)
• Reset account lockout counter after (observation window)

Check local security policy on standalone systems:

# Export current security policy
secedit /export /cfg C:\temp\secpol.cfg

# Review lockout settings in the exported file
Select-String -Path "C:\temp\secpol.cfg" -Pattern "LockoutBadCount|LockoutDuration|ResetLockoutCount"

Set up proactive monitoring for account lockout events to catch issues early:

# Create a scheduled task to monitor lockout events
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\LockoutMonitor.ps1"
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries
Register-ScheduledTask -TaskName "AccountLockoutMonitor" -Action $Action -Trigger $Trigger -Settings $Settings

Create the monitoring script (C:\Scripts\LockoutMonitor.ps1):

# Monitor for Event ID 4944 and send alerts
$LastCheck = (Get-Date).AddMinutes(-5)
$LockoutEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4944
    StartTime=$LastCheck
}

if ($LockoutEvents) {
    foreach ($Event in $LockoutEvents) {
        $EventXML = [xml]$Event.ToXml()
        $LockedAccount = $EventXML.Event.EventData.Data[0].'#text'
        $SourceWorkstation = $EventXML.Event.EventData.Data[4].'#text'
        
        # Send email alert or log to SIEM
        Write-EventLog -LogName Application -Source "LockoutMonitor" -EventId 1001 -Message "Account $LockedAccount locked from $SourceWorkstation"
    }
}

Configure Windows Event Forwarding to centralize lockout events:

winrm quickconfig
wecutil qc

Perform comprehensive analysis for security incidents or persistent lockout issues:

# Advanced event correlation script
$StartTime = (Get-Date).AddDays(-7)
$TargetAccount = "username"

# Collect comprehensive authentication events
$AuthEvents = Get-WinEvent -FilterHashtable @{
    LogName='Security'
    ID=4624,4625,4944,4740
    StartTime=$StartTime
} | Where-Object {$_.Message -like "*$TargetAccount*"}

# Create timeline analysis
$Timeline = $AuthEvents | ForEach-Object {
    $EventXML = [xml]$_.ToXml()
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        EventID = $_.Id
        EventType = switch($_.Id) {
            4624 { "Successful Logon" }
            4625 { "Failed Logon" }
            4944 { "Account Locked" }
            4740 { "Account Locked (Legacy)" }
        }
        SourceIP = if($EventXML.Event.EventData.Data[19]) { $EventXML.Event.EventData.Data[19].'#text' } else { "N/A" }
        WorkstationName = if($EventXML.Event.EventData.Data[13]) { $EventXML.Event.EventData.Data[13].'#text' } else { "N/A" }
    }
} | Sort-Object TimeCreated

$Timeline | Export-Csv -Path "C:\temp\AuthTimeline_$TargetAccount.csv" -NoTypeInformation

Check for indicators of compromise:

# Analyze authentication patterns for anomalies
$SourceIPs = $Timeline | Where-Object {$_.SourceIP -ne "N/A"} | Group-Object SourceIP | Sort-Object Count -Descending
$UnusualHours = $Timeline | Where-Object {$_.TimeCreated.Hour -lt 6 -or $_.TimeCreated.Hour -gt 22}
$MultipleWorkstations = $Timeline | Group-Object WorkstationName | Where-Object {$_.Count -gt 10}

Implement additional security measures if compromise is suspected:

# Force password reset for compromised account
Set-ADAccountPassword -Identity $TargetAccount -Reset -NewPassword (ConvertTo-SecureString "TempPassword123!" -AsPlainText -Force)
Set-ADUser -Identity $TargetAccount -ChangePasswordAtLogon $true

# Revoke all active sessions
Get-ADUser -Identity $TargetAccount | Set-ADAccountControl -AccountNotDelegated $true