Windows Server / Active Directory & Group Policy
Locate account lockout evidence on the relevant domain controller
Unlocking an account does not stop an old service or scheduled task from retrying the wrong secret. Collect the recorded lockout source and time.
Environment and inputs: Windows Server 2022 / 2025 baseline · Windows PowerShell with the specified role or RSAT modules; native utilities are identified in the text. Use delegated administration and elevation only where required.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4740; StartTime=(Get-Date).AddHours(-4)} -MaxEvents 30Read the result
Run with approved Security-log access on the relevant controller. Event availability depends on auditing and retention; inspect the caller information in the message.
Resolve and verify
Correlate the caller with server services, tasks and credential changes. Update the confirmed stale secret consumer before an approved unlock.
Before changing production
Never expose passwords while inspecting services. One controller's missing event does not prove no lockout occurred.