Windows account lockouts

Data required

Windows: Event logs

Procedure

1. Verify that you have deployed the Splunk Add-on for Microsoft Windows to the search heads and Splunk Universal Forwarders on the monitored systems. For more information, see About installing Splunk add-ons.
2. Run the following search. You can optimize it by specifying an index and adjusting the time range.

sourcetype="wineventlog" EventCode=4740 OR EventCode=644 
|eval src_nt_host=if(isnull(src_nt_host),host,src_nt_host) 
|stats latest(_time) AS time latest(src_nt_host) AS host BY dest_nt_domain user 
|eval ltime=strftime(time,"%c") 
|table ltime,dest_nt_domain user host 
|rename ltime AS "Lockout Time",dest_nt_domain AS Domain,user AS "Account Locked Out", host AS "Workstation"

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Next steps

The search results are presented in a table that shows the latest time of the lockout, the domain, the account that was locked out, and the workstation that the lockout condition was triggered on. 

A good next step would be to run this on a schedule, such as every 8 hours, and have the administrators on duty investigate and mitigate each lockout. Sometimes the account locked out is a script that has an embedded password that has expired. Other times, users have mistyped their credentials too many times and need help with recovery. A lockout can also indicate security issues, so it is advisable to coordinate these searches with the security team. 

To schedule a search like this, begin by saving the search as a report and then putting a schedule on to the search. The workflow for scheduling a report is documented here. 

Finally, you might be interested in other processes associated with the Investigating user login issues and account lockouts use case.