0 Replies Latest reply on Aug 17, 2018 4:33 AM by kreases

    Account Lockout EventID: 4740

    kreases

      I use the Windows Server 2008-2012 Domain Controller Security monitor to pick up on User Account: Account was locked out.

      However because the service desk has to actually click on the individual event to get the Caller Computer Name when they have numerous Domain Controllers to check I wondered if anyone had a way to just display the Accounts that are locked out along with the Caller Computer Name  which is the information the Service Desk requires.

       

      The Locked Out Users component displays the locked out users, I wondered perhaps does anyone know how to modify the script used in that to display the Caller Computer Name too. I have shown the information I require from the events below.

       

       

      Any help would be appreciated, thanks