Find Locking Computer Using Event Logs

1. Login to the Domain Controller where authentication took place.
2. Open “Event Viewer“.
3. Expand “Windows Logs” then choose “Security“.
4. Select “Filter Current Log…” on the right pane.
5. Replace the field that says “<All Event IDs>” with “4740“, then select “OK“.
6. 
   
7. Select “Find” on the right pane, type the username of the locked account, then select “OK“.
8. The Event Viewer should now only display events where the user failed to login and locked the account. You can double-click the event to see details, including the “Caller Computer Name“, which is where the lockout is coming from.
9.