Monitor user account lockouts with UIM: ntevl

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

Is it possible to monitor users' lockout in Windows and especially when the local admin account of a server is locked out? What probe can we use? 

Environment

Release : UIM 20.4, ntevl any version

Cause

Guidance

Resolution

User account lockouts are logged in Windows Server Event log under the eventid: 4740

Eg. 4740(S) A user account was locked out. (Windows 10) | Microsoft Learn

 

With the ntevl probe(for docs click here) you can monitor eventids generated in the Windows event logs and generate metrics and alarms from these events. 

You need a robot installed on the Windows system and have ntevl running there and create a profile for monitoring the event above mentioned. Apart from event ID matching you have additional Event Matching Criteria, where you can define, for example, specific matching for the admin account specifically. 

 

 

Additional Information

eventid: 4740
"This event generates every time a user account is locked out.
For user accounts, this event generates on domain controllers, member servers, and workstations."

So if it is a local user, the eventid will show on the same system where the probe is located.
If the lock occurs for a AD (Active Directory) user, the event should be logged on the domain controller server and not on the machine where the login failed.