Windows Event ID 4740: A user account was locked out
- Applicable version
- Windows Server 2008 R2 and later; Windows 7 and later
- Last reviewed
- 2026-07-21
Quick summary
Windows Security Event ID 4740 records a domain account lockout and is a key correlation point for brute-force activity and stale credential troubleshooting.
Technical Metadata
| Event ID | 4740 |
|---|---|
| Provider | Microsoft-Windows-Security-Auditing |
| Channel | Security |
| Level | Information |
| Audit keyword | Audit Success |
| MITRE ATT&CK | TA0006 Credential Access / T1110.001 Brute Force: Password Guessing; TA0006 Credential Access / T1110.003 Brute Force: Password Spraying |
| Key fields to watch | Account That Was Locked Out, Caller Computer Name, Subject |
Trigger Scenarios
A domain controller generates the event when failed authentication reaches the configured account-lockout threshold.
Key Fields
Account That Was Locked Out
The affected account. Determine whether it is a user, privileged, service, or shared identity.
Caller Computer Name
The computer that submitted the failed credentials. This is often the fastest path to the underlying source.
Subject
The domain controller context that recorded the lockout; it is not necessarily the user who caused it.
Threat Hunting Queries
SecurityEvent
| where EventID == 4740
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc- Data source
- Microsoft Sentinel SecurityEvent table
- Assumptions
- The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
index=wineventlog source="WinEventLog:Security" EventCode=4740
| table _time, host, user, EventCode, Message- Data source
- Splunk Windows Security event data
- Assumptions
- Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
dataset = microsoft_windows_raw
| filter edr_event_id = 4740- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
title: Windows Security Event ID 4740
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4740
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Security log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
MITRE ATT&CK Mapping
- T1110.001Brute Force: Password Guessing
- T1110.003Brute Force: Password Spraying
Detection Notes
T1110.001 Password Guessing and T1110.003 Password Spraying must be distinguished through CallerComputerName and policy values: repeated lockouts from one caller across many TargetUserName values inside the configured Account Lockout Observation Window are spray-like, while one account repeatedly locked from a familiar caller often reflects stale credentials. Correlate preceding 4625 SubStatus 0xC000006A bad-password failures and compare their count with the domain Account Lockout Threshold before alerting.
Common False Positives
- Stale credentials in services, mobile devices, and mapped drives commonly cause lockouts.
- Users can lock themselves out by repeatedly entering an old password.
Related Events
Sample Log
Account That Was Locked Out: CORP\jsmith
Caller Computer Name: WS-014
Computer: DC01Frequently Asked Questions
What does Windows Event ID 4740 mean?
Event ID 4740 records that a user account was locked out and identifies the locked account and, when available, the caller computer involved.
Does Event ID 4740 prove a brute-force attack?
No. Stale service, scheduled-task, mobile-device, or mapped-drive credentials can also reach the configured lockout threshold; analyze preceding authentication failures and the caller pattern.
How can CallerComputerName help with a lockout investigation?
One caller locking many accounts is more consistent with automated spraying, while repeated lockout of one account from a familiar host often points to a stored credential; the field can be empty in some authentication paths.
Sources
- 4740: Microsoft Windows security auditing event reference
Microsoft · vendor
- Brute Force: Password Guessing (T1110.001)
MITRE ATT&CK · attack
- Brute Force: Password Spraying (T1110.003)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule