Event ID 4740: A User Account Was Locked Out [Fix]

Finding the source of the event is important to resolve the issue

4 min. read

Updated onOctober 4, 2023

updated onOctober 4, 2023

Share this article

Improve this guide

Read our disclosure page to find out how can you help Windows Report sustain the editorial teamRead more

Key notes

If a user account is locked out, event ID 4740 is added to domain controllers, and event ID 4625 appears on client computers. It is generated whenan account is lockeddue to too many failed attempts.

The event has all the information about the user account that was locked out, the time of the lockout, and the source of the failed login attempts (caller computer name).

In this guide, we will discuss all the reasons for the event ID 4740 and how to find the source of account lockouts.

What causes Event ID 4740, a user account might be locked out?

There are various reasons for the event to be generated. Some of the popular ones are mentioned here:

What can I do to determine the source of the Event ID 4740 account lockout?

1. Enable Auditing for event 4740

2. Use PowerShell to find the PDC emulator role

3. Use Event Viewer

4. Use the Microsoft Lockout Status tool

5. Use a third-party tool

Using a free Active Directory troubleshooting tool likeNetToolshelps to troubleshoot, update queries, and report Active Directory and other Lightweight Directory Access Protocol directories. It is a portable executable file that allows you to view and troubleshoot Active Directory permissions.

NetTools searches the event logs to locate events relevant to the account on the selected domain controller. Also, it can find the event logs of any member servers in the authentication chain and can display the information related to the reason for the lockout. To know the source, follow these steps:

So, these are the easiest ways to find out thesource of account lockoutevent ID 4740. Once you get the source, you can easily take steps to prevent it from happening.

Have you already tried some of these solutions? Or maybe you know of other methods to solve this Windows event ID? Feel free to share your expertise with us via the comments section below.

Event ID 4740: A User Account Was Locked Out [Fix]#

What causes Event ID 4740, a user account might be locked out?#

What can I do to determine the source of the Event ID 4740 account lockout?#

1. Enable Auditing for event 4740#

2. Use PowerShell to find the PDC emulator role#

3. Use Event Viewer#

4. Use the Microsoft Lockout Status tool#

5. Use a third-party tool#