Skip to main content
AD Academy
Back to all recipes
Level: JuniorLast updated:

Weekly account lockout report

Get-WinEvent -ComputerName (Get-ADDomain).PDCEmulator -FilterHashtable @{
  LogName='Security'; Id=4740; StartTime=(Get-Date).AddDays(-7)
} | Select-Object TimeCreated,
    @{n='User';e={$_.Properties[0].Value}},
    @{n='Source';e={$_.Properties[1].Value}} | Sort-Object TimeCreated -Descending

Why it works this way

The same three users every week means a recurring technical cause (phone, service), not carelessness.

Watch out

  • 4740 is written only on the PDC Emulator — that is why we query it directly.
  • The Source column is the gold: it names the device causing lockouts.

Related events

Similar recipes