ZEKASTRA

SecurityAccount management

4740 · A user account was locked out

Generated every time a user account is locked out after exceeding the lockout threshold. On domains it is recorded on the domain controller.

01Fields in the event

  • TargetUserName
  • TargetDomainName
  • TargetSid
  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId

02How to use it

The caller computer name shown in the event points to where the failed attempts came from; follow it to 4625/4771/4776 on that host or the domain controller.

03Caveats

Requires Audit User Account Management. The caller is given as a computer name, not an IP address, even for computers outside the domain.

05Sources

  1. Microsoft Learn — 4740(S) A user account was locked out checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.