Sign in

Event 4740 Told Us WHERE. It Took An Old Phone To Explain WHY

active-directorylockoutwindows15 replies · 498 views · started
Reply
  1. Aiden Torres
    @aident824

    im literally losing my mind here a service desk tech changed their password on Monday. since then the account locks every time they open Outlook:

    This app can't run on your PC

    This app can't run on your PC

To find a version for your PC, check with the
software publisher.

    we suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else. how do we narrow it down??

    Weve already asked them to sign out everywhere, but thats easier said than done when nobody knows where everywhere is. Is there a reliable way to find teh source of the bad password attempts?

    14
  2. Priya Schmidt
    @tensor_tinker-2mh

    what does event 4740 on the PDC emulator show as teh Caller Computer Name?? ?

    thinking

    19 6 helpful
  7. Idris Grant
    @igrant_30

    hmmm which version are you on?. +1 same here

    8 0 helpful
  9. Omar
    @omaro579

    find the source first. on the PDC emulator, look in the Security log for event ID 4740 (account locked out). the Caller Computer Name field shows where the bad attempts came from... event 4625 (failed logon) and 4771 (Kerberos pre-auth failed) on DCs show teh client address too. hope that helps :)

    0 2 helpful
  10. Omar
    @omaro579
    in reply to @omaro579

    lol same thing happened to me make a backup before u touch the thermal paste, learned that the hard way

    0 1 helpful
  11. Priya Schmidt
    @tensor_tinker-2mh
    in reply to @omaro579

    been there man microsofts Account Lockout Status tool (LockoutStatus.exe) shows bad password count and last bad password time per DC, which quickly shows which site teh attempts hit.

    3 0 helpful
  12. Omar
    @omaro579

    finally got it working, thx everyone. same issue here on my mac. no idea whats going on cant believe it was that simple lol

    0 2 helpful
  13. Priya Schmidt
    @tensor_tinker-2mh

    ok so after a password change, the usual suspects are: phones with a mail profile still using the old password, mapepd drives with saved credentials, Credential Manager entries, scheduled tasks or services running as that user, and disconnetced RDP sessions on some server. hope that helps :)

    5 3 helpful
  14. Omar
    @omaro579

    yeahhh exact same thing happened to my gamnig rig last month

    15 1 helpful
  15. Xavi P.
    @xavi.pereira

    ok this thread just saved my weekend, wait does this also apply to windows??

    6 12 helpful
  16. Zora Fontaine
    @zoraf835

    oh ive been there lol if teh caller is an Exchange or ADFS/web server, the bad attempts come from outside (a phone or an attacker). Check that servers logs (IIS logs, ADFS events) for the client IP and user agent. Smart lockout on the cloud side and blocking legacy auth help a lot against password spraying.

    5 0 helpful

Reply to this topic

Sign in or create an account to reply.