SOC Event Lookup
Event ID 4767AccountMgmtP2

Windows Event ID 4767: A user account was unlocked

Applicable version
Windows Server 2008 R2 and later; Windows 7 and later
Last reviewed
2026-07-21

Quick summary

Windows Security Event ID 4767 records that a locked-out user account was unlocked, logging the Subject who performed the unlock and the Target Account that was unlocked.

Technical Metadata

Technical metadata for Event ID 4767
Event ID4767
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
Audit keywordAudit Success
MITRE ATT&CKTA0003 Persistence / T1098 Account Manipulation
Key fields to watchTarget Account\Account Name / Security ID, Subject\Account Name / Logon ID

Trigger Scenarios

A domain admin or help-desk operator unlocks an account through the ADUC console, PowerShell, or a self-service portal after a lockout. In an attack context, an adversary who has triggered a lockout on their own account or a captured account may unlock it themselves using separately obtained admin credentials to restore operational access.

Key Fields

Target Account\Account Name / Security ID

The account that was unlocked. Unlocking a domain admin or service account outside a help-desk ticket is the primary T1098 Account Manipulation signal; compare with the 4740 lockout record for the same account to confirm the unlock follows the lockout immediately.

Subject\Account Name / Logon ID

The identity that performed the unlock. Per the Microsoft Security Monitoring Recommendation, every 4767 for a local account should be reviewed. For domain accounts, an unlock performed by an account that is not in the authorized help-desk group or that originates from an unusual workstation warrants investigation.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Event ID 4767
SecurityEvent
| where EventID == 4767
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Apply the event-specific field and correlation guidance on this page after retrieving the base events.
Query reference
Splunk SPL: Retrieve Windows Event ID 4767
index=wineventlog source="WinEventLog:Security" EventCode=4767
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source, and field aliases vary by Splunk deployment and Windows add-on version. Map provider fields from the raw event before adding event-specific filtering or aggregation.
Cortex XQL: Retrieve Windows Event ID 4767
dataset = microsoft_windows_raw
| filter edr_event_id = 4767
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The Windows Security channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4767
title: Windows Security Event ID 4767
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4767
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the field conditions and correlations documented on this page in the destination SIEM.
Query reference

MITRE ATT&CK Mapping

  • T1098Account Manipulation

Detection Notes

T1098 Account Manipulation is supported when a 4740 lockout is followed by 4767 from a SubjectUserName outside the approved help-desk or identity workflow and the target later produces a 4624 Logon Type 10 from a new source. Event 4767 has no Status code, so use a local threshold=1 for privileged-account unlocks and correlate SubjectLogonId instead of inventing a result value.

Common False Positives

  • Help-desk operations routinely unlock accounts after user-initiated lockouts from stale passwords on mobile devices or mapped drives.
  • Automated self-service portals produce 4767 events with a service-account Subject when users reset their own passwords.

Related Events

Sample Log

Sanitized event sample
Subject:
  Security ID: CORP\attacker-admin
  Account Name: attacker-admin
  Account Domain: CORP
  Logon ID: 0x7C3E10
Target Account:
  Security ID: CORP\da-account
  Account Name: da-account
  Account Domain: CORP

Frequently Asked Questions

What does Windows Event ID 4767 mean?

Event ID 4767 records that a locked Windows user account was unlocked and identifies the actor and target account.

Does 4767 contain a status or caller-computer field?

No. Its documented fields are identity and logon identifiers; use 4740 and authentication events for lockout origin and failure context.

Which account unlocks are suspicious?

Unexpected unlocks of privileged, dormant, or compromised accounts by an unapproved subject should be correlated with later successful logons.

Sources