Account lockout tool

Account lockout analysis with ADAudit Plus

What is an account lockout tool?

An account lockout tool identifies why a user account in Active Directory was locked out and where the locking authentication originated. When a domain account exceeds the bad-password threshold in your account lockout policy, Windows locks it. The lockout event itself is straightforward to detect, but tracing it back to the source requires correlating Event ID 4740 across multiple domain controllers and reconstructing a timeline from fragmented data. ADAudit Plus replaces that manual process entirely.

Find the lockout source instantly

The Account Lockout Analyzer goes beyond recording which domain controller recorded the lockout. It identifies what caused it and pins the source to the specific device, service, or credential store. You get the locking source, the client machine, the IP address, and the preceding logon history in a single report row.

The most common sources the Analyzer surfaces:

• Stale credentials stored on a device after a password change
• Mapped drives authenticating with an old password
• Mobile devices using cached credentials that were not updated
• Scheduled tasks or services running under the account with an outdated password

 

 

Identify the primary source of continuous AD account lockouts by analyzing multiple components, including network drive mappings, process lists, applications, and more.

 

 

Obtain more perspective into locked out user accounts by analyzing recent logon details.

Track every lockout event across the domain

A single lockout is usually a support ticket. A pattern of lockouts across multiple accounts or workstations is a security signal. ADAudit Plus gives you the full domain-wide picture through pre-built reports:

• Recently Locked Out Users: gives you every lockout event across all domain controllers in a single view, so you can spot recurring patterns, repeat accounts, and distributed spikes.
• Recently Unlocked Users: captures every unlock action with the identity of who performed it and when, giving you a complete audit trail alongside the lockout record.
• Logon Attempts by Locked Out Users: shows authentication attempts made by accounts that are already locked out. Continued attempts after lockout are a reliable sign of an automated attack, not a confused user.

All three pull from every domain controller centrally. You never need to log into individual DCs or piece together a picture from multiple security event logs.

 

 

Find recently locked out AD user accounts and their relevant details including when, from where, and by whom.

Monitor and audit lockout policy changes

Raising the lockout threshold or shortening the lockout duration makes your environment measurably more vulnerable to password-guessing attacks. ADAudit Plus tracks every change to these settings through the Account Lockout Policy Changes report, capturing who made the change, what the before and after values were for the lockout threshold, duration, and reset interval, and the exact timestamp of each modification.

For tighter control, you can configure a dedicated alert for Account Lockout Policy Changes alone, so the right team is notified the moment anyone touches those settings.

Detect lockout anomalies with user behavior analytics

Isolated account lockouts are routine. A sudden spike in lockouts across multiple accounts, or a cluster of lockouts at 3 a.m., is not. ADAudit Plus applies machine learning to build a baseline of normal lockout activity for your domain, then flags deviations the moment they occur. Two dedicated UBA reports in the Analytics tab handle this:

• Unusual Volume of Lockout: fires when lockout frequency exceeds the learned domain baseline. A spike consistent with a brute-force or password spray attempt will surface here before the volume starts affecting normal users.
• Unusual Lockout Activity Time: flags lockout events occurring outside the normal time window for your domain. Lockouts against privileged accounts at 2 a.m. or 3 a. m. are not a misconfiguration. They are an attack in progress.

Get real-time alerts on account lockouts

Your team needs to know the moment a lockout fires, not when they open the next morning's report. ADAudit Plus ships with a default account lockout alert profile that works out of the box. When it triggers, the alert puts your team in a position to act immediately:

• You know which account was locked, so you can contact the right user without a lookup.
• You know the machine and IP address that caused it, so you can determine whether the source is a known corporate device or something unexpected.
• You know the domain controller that recorded the event, so investigation starts at the right point.

When the alert fires, ADAudit Plus can also auto-create a ticket in your ITSM platform. Supported integrations include ServiceNow, Jira, Zendesk, ManageEngine Service Desk Plus, Freshservice, and Kayako. The ticket arrives pre-populated with event details, so your help desk has what they need without waiting on the security team.

For environments where lockouts are expected to be rare, you can set a custom threshold so notifications fire only after a defined number of events within a rolling window, separating a user who mistyped their password twice from an active credential-stuffing attempt against your domain.

Extend lockout visibility to Microsoft Entra ID

Account lockouts are not limited to on-premises Active Directory. Microsoft Entra ID, previously known as Azure Active Directory (Azure AD), enforces its own lockout policy for cloud-authenticated accounts. A hybrid environment can produce lockouts in both directories simultaneously. ADAudit Plus gives you a single console for both. The Cloud Directory tab covers:

• Account Locked Out Users: lets you act on Entra ID lockout events immediately, with the triggering application, source IP address, geo-location, and MFA details already surfaced in the same record.
• Hybrid Logon Activity: correlates sign-in events across on-premises AD and Microsoft Entra ID, so you can determine whether a lockout in one directory is connected to authentication activity in the other.
• Login by PasswordSpray Account: lets you respond to a password spray attack in Entra ID before it translates into an on-premises lockout spike, a cloud-side signal that often precedes on-premises credential attacks.

When a lockout spike hits both directories at the same time, that correlated view is what lets you escalate to an incident response workflow immediately rather than spending the first hour ruling out a coincidence.

 

 

Find locked out Entra ID user accounts and their relevant details including User Principal Name, On-prem SID, caller IP, and more

Why native tools fall short

Microsoft provides two free utilities (LockoutStatus.exe and ALTools.exe) for investigating account lockouts, and both have real limits. Neither tool handles:

• Real-time alerting when a lockout occurs
• Historical trend analysis or lockout frequency baselines
• UBA-driven anomaly detection for lockout spikes
• Automated ITSM ticket creation
• A centralized audit trail across all domain controllers without manual CSV correlation
• Coverage of Microsoft Entra ID lockout events

In any environment where lockouts affect business continuity, trigger support tickets, or need to be correlated with security events, these gaps cost real time. ADAudit Plus covers all of it: root cause identification, real-time alerts, ITSM ticket creation, and Entra ID coverage, without manual log correlation or per-machine investigation.