Event Log Monitor Issues - User account locked out

I setup the User Account lockout template to monitor the event log and to send out an alert when an account gets locked out. Below is the component monitor setup. I am spinning my wheels here trying to figure out why it is not working.

I checked GPO and the policy is enabled to write this to a the security log
The security logs flip every 30 mins or so
I have searched for 4740 and nothing comes up
We do have users that are currently locked out.

This should be easy but for some reason I can't get this. Maybe our logs are flipping too fast? Thanks!

Find more posts tagged with

active directory lockouts

event and alerts

Accepted answers

All comments

christopher.t.jones123

What does it say when you test it?

steffen.gutzeit

Hello.

I'd start by leaving the log source and event inclusion empty, as well as setting the event type to any. Then assign this app template to the server that is hosting Active Directory.

Best regards,

Steffen

martian_monster

When I test it says up. We have had account lockouts and they are not registering in AD so not sure what I am missing.

martian_monster

Thanks! I will give that a try.

martian_monster

I did what you suggested and still a no go. We finally saw the event ID 4740 on a DC and it still did not pick it up in Solarwinds. I am thinking I may create this monitor from scratch and see if it works.

christopher.t.jones123

hmm perhaps you can turn on debugging and then look at the log and see if that sheds any light on why its not working as expected

steffen.gutzeit

A more lightweight solution would be the Log Analyzer module of Orion which can show you all of the Windows events: Windows System Event Log Monitoring Software and Log Collector | SolarWinds

jack.vaughan

Perhaps this is a better alternative? I use this in our environment currently. Doesn't depend on the logs being around long enough to react.

AD Locked Out Accounts

martian_monster

Yeah we are discussing using PS for this since I can't get this to work correctly.

jack.vaughan

Oh! Having "Security" in the Log Source field could be causing an issue. Event ID 4740 is only used for locked out accounts, so all the extra detail you have the component matching could be throwing it off.

Just use the following:
Log to Monitor: SecurityMatch only specific IDs: 4740

martian_monster

I did some additional changes this morning to open up the component a bit to see if it will start working. Otherwise power shell it is.

jack.vaughan

This worked for me by alerting just this morning.

2020-01-13 11.44.17 sysmon.connectria.com 6a223225e7b8.png

martian_monster

The monitor I was using was something I downloaded off of THWACK and there must have been something goofy in it. To test my theory I created a new event monitor from scratch to check for 7470 and it started working. I will call it IT Magic.