> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/investigate-account-lockout.md).

# Investigate an Account Lockout

## Objective

Investigate a lab account lockout and identify the affected account, the time of the lockout, and the system associated with the activity.

## Lab Systems

* `DC01`
* `CLIENT01`

## Before You Begin

Use only a dedicated lab account. Do not use a privileged account for this exercise.

If the lab account lockout policy is already configured from the earlier Windows security exercise, use that policy. Otherwise, review the previous account lockout lab before continuing.

## Generate Test Activity

Use the dedicated test account and intentionally enter an incorrect password only enough times to reach the lab lockout threshold.

Stop when the account becomes locked.

## Find the Lockout Event

On `DC01`, open:

```
Event Viewer
Windows Logs
Security
```

Filter for:

```
4740
```

Event ID `4740` records an account lockout.

## Investigate the Event

Review:

* locked account name
* time of the event
* caller computer name when available
* surrounding authentication failures

Also search for Event ID `4625` in the same time window to understand what happened before the lockout.

## Build the Sequence

A simple investigation sequence may look like this:

```
4625  Failed logon
4625  Failed logon
4625  Failed logon
4740  Account locked out
```

The exact number of failures depends on the lab policy.

## Investigation Questions

1. Which account was locked?
2. Which computer was associated with the failures?
3. How many failed attempts occurred before the lockout?
4. Was the activity expected?
5. Did anything unusual happen after the account was unlocked?

## Clean Up

Unlock the dedicated lab account using Active Directory Users and Computers when the investigation is complete.

Confirm that the user can authenticate normally again.

## Security Relevance

Account lockouts can result from typing mistakes, old saved credentials, services using outdated passwords, or repeated unauthorized attempts.

The event is useful because it provides a starting point. The investigator still needs to review the events leading up to the lockout to understand the cause.