I am facing issue with few users as their AD ID is getting locked frequently.
Observation:
During account lockout, security event ID 4740 is getting generated on the domain controller.
In Additional Information the "Caller computer name" is blank.
Based on various technet & other blogs caried out troubleshooting with below tools.
* lockoutstatus,
* ALockout.dll
*Psexec.exe
*cmdkey.exe
*Aloinfo.exe
*FindStr.exe
*Netwrix.exe
*ADLockouts.exe
*NlParse.exe
The only identified hostnames with few of the tools are users own hostname, hostname of DC & RADIUS server. But still no saved of any specious program or service found on the system or servers.
Does anyone have idea regarding this issue.
Pls find below snap for the same.
- Sumit Duduskar.