How to track down why and where the Active Directory user account was locked out ?

 Tracking down why and where an Active Directory user account was locked out involves a series of steps. Here's a guide to help you:

1. Check Event Logs:

   - Start by examining the Event Viewer logs on the domain controller(s) for relevant entries. Look for Event ID 4740 (Account Lockout) in the Security log.

   - You can filter the logs to only show events related to the specific user account in question.

2. Identify Source:

   - Look for the Caller Computer Name field in the Event ID 4740 entry. This will give you the name of the computer where the lockout originated.

   - Use the information from the Caller Computer Name field to track down the source of the lockout.

3. Review Logs on Source Machine:

   - Log in to the source machine identified in the event logs.

   - Check Security logs on the source machine for events that coincide with the lockout time. Look for failed login attempts from the user account.

4. Check Scheduled Tasks and Services:

   - Review any scheduled tasks or services running under the user's credentials on the source machine.

   - Any task or service using outdated credentials can lead to account lockouts.

5. Examine Network Drives and Services:

   - If the user has network drives mapped or is accessing network services, ensure there are no stale connections using outdated credentials.

   - Update any saved credentials associated with network drives or services.

6. Audit Group Policy Changes:

   - Check if any changes were made to Group Policies that could potentially affect account lockout policies.

7. Use LockoutStatus Tool:

   - Microsoft provides a tool called LockoutStatus which can be helpful in determining which domain controller recorded the lockout and the status of the account across all domain controllers. This can help pinpoint if it's a specific DC causing the issue.

8. Review Third-Party Applications:

   - If there are third-party applications integrated with Active Directory, ensure they are not causing the lockout issue due to misconfigured authentication settings.

9. Password Expiry and Change Policies:

   - Ensure that the user is aware of password expiration policies and has recently changed their password if necessary.

10. Consider Account Compromise:

    - If none of the above steps reveal the cause, consider the possibility of the account being compromised. In this case, it's crucial to immediately disable the account and investigate further for security breaches.

By following these steps, you should be able to track down why and where the Active Directory user account was locked out.