AD Account are being locked but only some are showing as 4740 in Domain controller

We have been seeing increasing number of AD Account lockouts.

Some of these lockouts show up in event viewer as 4740 events but most do not show up at all. My account has been locked out almost once a day, there is never a 4740 event associated with it. However, if I try to login in with a bad password eg:BadPwd123 till my account is locked out, I see the 4740 in eventviewer.

Are there other event lockouts other than 4740 That I can be searching for?

I have already enabled

Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies-> 

enter image description here

4

Reset to default

Know someone who can answer? Share a link to this question via email, Twitter, or Facebook.

Your Answer

Sign up or log in

Sign up using Google Sign up using Facebook Sign up using Email and Password

Post as a guest

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

You Might Also Like