// REFERENCE
4740 — Account locked out
Log: Security
Medium risk
An account was locked after exceeding the failed-attempt threshold. A spike of 4740 is the echo of a brute-force or spraying attack (correlate with 4625). Identify the caller computer that triggered the lockout.
Related tools
Work with this in:
Related
4720
4720 — User account created 4722
4722 — User account enabled 4723
4723 — Password change attempt 4724
4724 — Password reset attempt 4725
4725 — User account disabled 4726
4726 — User account deleted
4720 — User account created 4722
4722 — User account enabled 4723
4723 — Password change attempt 4724
4724 — Password reset attempt 4725
4725 — User account disabled 4726
4726 — User account deleted
Original descriptions based on Microsoft's public documentation. IDs and fields may vary with the Windows version and the active audit policy.