OpsVantage Tools
Tools Guides Event IDs opsvantage.net
Tools / Event IDs / Event ID 4740

Event ID 4740: account locked out

What Event ID 4740 (account locked out) means, the fields to check, what is normal and what is suspicious, with PowerShell and KQL queries to find it.

Log: Security · Severity: Low · MITRE ATT&CK T1110 · Updated 2026-11-03

Event ID 4740 means an account was locked out. It is logged on the domain controller, usually the PDC emulator, and its most useful field is the computer the bad attempts came from. That turns "my account keeps locking" from a mystery into a five-minute fix.

The fields that matter

FieldWhat it tells you
Target AccountThe account that was locked.
Caller Computer NameThe machine the failed attempts came from.
SubjectUsually the domain controller itself.

What is normal

A user who changed their password and still has the old one saved on a phone, a mapped drive or another session.

When Event ID 4740 is suspicious

Common false positive: Phones syncing mail through Exchange often show the Exchange server as the caller. Check that server's logs for the device behind it.

Find Event ID 4740 with PowerShell

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 50 |
  ForEach-Object {
    $d = [ordered]@{ Time = $_.TimeCreated; Computer = $_.MachineName }
    ([xml]$_.ToXml()).Event.EventData.Data | ForEach-Object { $d[$_.Name] = $_.'#text' }
    [pscustomobject]$d
  } | Format-List

Microsoft Sentinel (KQL)

SecurityEvent
| where TimeGenerated > ago(7d) and EventID == 4740
| project TimeGenerated, Computer, Account, Activity, EventData
| order by TimeGenerated desc

Related events

FAQ

How do I find the source of repeated lockouts?

Take the Caller Computer Name from 4740, then look at 4625 events on that machine for the account: the process name and logon type show what is using the old password.

Which event shows an account being unlocked?

4767.