Why can't I find event 4740?

Account lockout auditing must be enabled in the policy, and the event is logged on the DC holding the PDC emulator role.

Does raising the lockout threshold help?

No. It only postpones the symptom and weakens protection against password attacks.

AD account keeps getting locked out: find the source

After a password change, an account gets locked again and again. Unlocking only helps briefly, because somewhere a device or service keeps trying to sign in with the old password. The fix is to find that source.

1. Check the lockout status

Confirm the account is really locked and look at the number of failed attempts.

$ Get-ADUser j.meier -Properties LockedOut,BadPwdCount,LastBadPasswordAttemptLockedOut : True

2. Find the source with event 4740

Every lockout creates security event 4740 on the domain controller holding the PDC emulator role. The “Caller Computer Name” field names the device the failed attempts came from.

$ Get-ADDomain | Select-Object PDCEmulatorsearch on this DC

$ Get-WinEvent -FilterHashtable @{LogName='Security';Id=4740} -MaxEvents 5read the Caller Computer Name

3. Typical sources

A phone with the old password in its mail account, saved credentials in Windows Credential Manager, disconnected RDP sessions, mapped drives with a stored password, or a service or scheduled task running under the user's account.

4. Fix it

Unlock the account only after you've updated or removed the source. Otherwise it will be locked again within minutes.

$ Unlock-ADAccount -Identity j.meieronly after fixing the source

FAQ

Why can't I find event 4740?: Account lockout auditing must be enabled in the policy, and the event is logged on the DC holding the PDC emulator role.
Does raising the lockout threshold help?: No. It only postpones the symptom and weakens protection against password attacks.

Last updated: 2026-11-08