Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a user account that keeps on getting locked out. I am trying to find out what caused it. So I want to enabled failure audits in event viewer as a start. But, I don't know how!

How do I enable Audit Failures such that it shows up in the DC's event viewer under Windows Logs > Security?

The steps I have done so far:

  • In the DC, go to Group Policy Management Editor > Default Domain Policy (Linked) > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Audit Policy
  • Set the Audit account logon events, directory services access, logon events to "failure". account management is already set to "Success, Failure".
  • In the DC, start the command prompt, type gpupdate.

The event log still shows only Audit Success only, even though it can be checked that my user account is getting bad password count every few minutes or so.

share|improve this question
You were so close! See the 1st answer below. – SturdyErde May 24 '12 at 10:05

4 Answers 4

up vote 5 down vote accepted

Do this on the "Default Domain Controller" Policy to apply to the DC's

share|improve this answer
AH... should have known it! – Jake May 25 '12 at 1:43

Yes, you need to edit on Default Domain Controller policy, otherwise you need to create new GPO and link it to the Domain Controllers OU. Once you have done it in any of these two ways, you need to watch the User Account Management events

4740 - for locked out.

4767 - for unlocked.

Refer this article to know how to enable auditing in active directory

and for complete event ID list

share|improve this answer

Indeed, if you need to enable/disable auditing in Active Directory, you need to change the default Domain Controller's policy, not the domain policy. This is because the auditing is done on the DCs and it is the default Domain Controller's policy that governs policy on DCs.

share|improve this answer

You can use Microsoft Lockout Status Tool to help identify which AD server is recording the bad password attempts, this should help narrow the scope!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.