How do you identify all accounts not automatically locked after 5 consecutive failed log in attempts?

[sahiltcs]

I need to check how to identify all technical accounts that are not automatically locked after 5 consecutive failed log in attempts

Please help with the query

Thanks,
Sahil

[lakshman239 · Accepted solution]

When an account gets locked out, Active Directory sends out EventCode=4740. So, if you are indexing AD security logs, you could check for lock-outs using

index=wineventlog EventCode=4740 Account_Name=* ..... shows all locked accounts.

index=msad | timechart span=5m sum(badPwdCount) AS total by sAMAccountName ... gives count of lockouts for each user.

So, you can run the 2nd search to check for lockout counts and check if you have a 4740 event for that user. If there is no record, that could potentially indicate an account not getting locked out.

[sahiltcs]

I checked Above query but not worked , Can you give me proper query so that I can test, May be query is right but some argument is missing.

Thanks,
Sahil