WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > Account Lockout

Account Lockout

I have not observed any events logged by this category. If you have, help us out and post them in this event's discussion forum.

Strangely, the events for account locked out and unlocked are in User Account Management.

As will all subcategories you must use auditpol to enable or disable it.

Coverage on events generated by this category are currently in the Security Log Encyclopedia.

Back to top

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources