Find A Computer That Is Locking Out A User In Active directory

This article will show you how to find a computer that is locking a user Active Directory account.

In this article I’ll use two tools to get the data.

The first tool is Microsoft Account Lockout and Management Tools from the link below:

The second tool Is the Event Viewer on the DC.

Once you download the Account Lockout Tool save it run it

Open the extracted files and run LockoutStatus.exe as administrator

Open the tool and click on File -> Select

In the Target User Name type the User ID that his \ her account Is getting locked Out

In the second Username option type the Administrator account details.

If you running the tool from a DC you can tick the box.

View the returned results and note the Orig Lock DC

Log In to the DC and create a filter In the security log for the last 24 hours with event ID 4740 and click OK

Select the event from the result

Note the Caller computer Name