> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/account-lockout.md).

# Account Lockout

## Objective

Understand how an account lockout works and learn how to identify the related Windows security event.

## Important Lab-Only Note

Changing an account lockout policy affects domain users. Perform this only in the isolated ZyberLab domain.

Do not copy these values directly into a production environment without considering organizational policy, user impact, help-desk processes, and current security guidance.

## Why a Policy May Be Required

A new Active Directory domain may not lock an account after failed passwords unless an account lockout threshold is configured.

For this exercise, use a simple lab-only policy.

## Configure a Lab Lockout Policy

On `DC01`:

1. Open **Group Policy Management**.
2. Edit the domain policy used for the lab.
3. Navigate to:

```
Computer Configuration
└── Policies
    └── Windows Settings
        └── Security Settings
            └── Account Policies
                └── Account Lockout Policy
```

For the lab, you can use:

| Setting                             | Lab value          |
| ----------------------------------- | ------------------ |
| Account lockout threshold           | 5 invalid attempts |
| Account lockout duration            | 15 minutes         |
| Reset account lockout counter after | 15 minutes         |

Allow policy time to apply before testing.

## Generate the Lockout

On `CLIENT01`:

1. Sign out.
2. Attempt to sign in as the test domain user with an incorrect password until the configured threshold is reached.
3. Stop once the account becomes locked.

Use only the dedicated lab account.

## Review the Event

On `DC01`, open:

```
Event Viewer
└── Windows Logs
    └── Security
```

Filter for:

```
4740
```

Review fields such as:

* Account Name
* Account Domain
* Caller Computer Name
* Time Created

## Unlock the Test Account

On `DC01`:

1. Open **Active Directory Users and Computers**.
2. Locate the test user.
3. Open the account properties.
4. Unlock the account if it remains locked.

Then verify that the user can sign in normally again.

## What Happened?

The domain recorded repeated authentication failures and enforced the configured account lockout policy. The lockout itself generated Event ID 4740 on the domain controller handling the event.

## Security Relevance

Account lockouts may indicate:

* a user repeatedly entering an old password
* stored credentials in an application or service
* a password-spraying or brute-force attempt
* a compromised device repeatedly authenticating with invalid credentials

An account lockout is therefore both a user-support event and a possible security signal.

## Key Takeaways

* Event ID 4740 records an account lockout.
* Lockouts depend on configured domain policy.
* The caller computer can help identify where the failures originated.
* Repeated lockouts should be investigated rather than simply unlocked.