Having an issue with auditing a network for logins. I am looking for Event 4740 but the logs are not showing them. Neither on the local machines either.

I have verified that Account Management Auditing has been enabled and is set to Success And Failure and I have checked the Logon/Logoff policy for Account Lockout to Success. I have tested the account on a domain machine and the log on the machine shows the account failing but never logs that the account is locked out.

When I check the Domain Controllers it shows the account failed to login but is showing NULL SID. Even then it does not show the lockout event either.

Anyway to figure out why it is not logging the Lockout event with it enable to do so?

  • Is the account being locked out? – Greg Askew Nov 20 '15 at 18:41
  • I may have found the answer. The NULL SID led me to create a new account and then try an lock myself out. When I did that the event started working again. Not sure what caused the NULL SID as I have done no work to it but seems to be working now. – JukEboX Nov 20 '15 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.