--- title: "How to Find Locked Out Users in Active Directory with PowerShell" description: "Learn how step-by-step, how to find locked out users in Active Directory with PowerShell in this in-depth tutorial!" canonical: "https://adamtheautomator.com/find-locked-out-users-in-active-directory-powershell/" --- # How to Find Locked Out Users in Active Directory with PowerShell > Learn how step-by-step, how to find locked out users in Active Directory with PowerShell in this in-depth tutorial! Source: https://adamtheautomator.com/find-locked-out-users-in-active-directory-powershell/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![How to Find Locked Out Users in Active Directory with PowerShell](https://adamtheautomator.com/wp-content/uploads/2019/07/panic-1393619_1280.png) # How to Find Locked Out Users in Active Directory with PowerShell [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)30 November 20213 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Active Directory](/tag/active-directory/)[PowerShell](/tag/powershell/) Table of Contents * [Find Locked Out Users in Active Directory with PowerShell](#finding-locked-out-accounts) * [Find the PDCe Role Holder](#find-the-pdce-role-holder) * [Scouring the Event Log for Lockouts](#scouring-the-event-log-for-lockouts) * [Parsing the Username and Location](#parsing-the-username-and-location) * [Leveraging PowerShell to Unlock AD Accounts](#leveraging-powershell-to-unlock-ad-accounts) * [Summary](#summary) Do the users in your organization ever forget their passwords? Surely not! Has an [Active Directory](https://adamtheautomator.com/tag/active-directory/) user locked out their account? No way! Let’s see what we can do to find locked out users in Active Directory with PowerShell! Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** > _Stop struggling with password reset calls and account lockouts in Active Directory. [Get a FREE trial of Specops uReset.](https://specopssoft.com/contact-us/?utm_source=ata&utm_medium=referral&utm_campaign=na_ata&utm_content=mention)_ Has your network ever been infected with malware that attempts to authenticate with as many domain user accounts as possible? I hope not but I’ve seen it happen a few times. Users and worms are just two of the reasons one or more AD accounts can get locked out. Depending on your password policy, lockouts may be a daily occurrence or only happen occasionally. Regardless of the reason or situation, account lockouts affect your users. Since they depend on their Active Directory domain account for nearly everything, they’ll immediately notice when it is locked out. The account can be re-enabled by your helpdesk but what if it happens again? …and again. …and again. Figuring out the root cause of this problem is important. One way to do this is to use [PowerShell](https://adamtheautomator.com/tag/powershell/) and the ActiveDirectory module. By using the `Search-AdAccount` cmdlet inside of the [Active Directory module](https://adamtheautomator.com/powershell-import-active-directory/ "Active Directory module"), you can easily track down all of the accounts that are currently locked out across your domain. **_Related: [How to Install the Active Directory PowerShell module](https://adamtheautomator.com/powershell-import-active-directory/)_** ## Find Locked Out Users in Active Directory with PowerShell To search for locked out accounts, you can run the `Search-AdAccount` command using the `LockedOut` parameter. This will return all users currently locked out granted you have the right to see that. ```powershell Search-AdAccount -LockedOut ``` This command is great but what if you have an account that is continually getting locked out and you need to figure out from which system it’s coming from? This is a common task whenever you have a malware infection somewhere on your network or perhaps when you have a forgetful admin that forgot to log out of a remote desktop session. That’s never happened, right? To find the source of an Active Directory lockout, you’ll first need to ensure you’re querying the right domain controller. In this case, this will be the domain controller with the PDC emulator role. ## Find the PDCe Role Holder All password authentication will come to this DC holding the PDCe role so it is always the best place to check. To find the domain controller with the PDCe role, you can check the `PDCEmulator` property returned from the `Get-ADDomain` cmdlet. ```powershell $pdce = (Get-ADDomain).PDCEmulator ``` ## Scouring the Event Log for Lockouts One you have the DC holding the PDCe role, you’ll then need to query the security event log (security logs) of this DC for event ID 4740. Event ID 4740 is the event that’s registered every time an account is locked oout. Do this with the `Get-WinEvent` cmdlet. ```powershell Get-WinEvent -ComputerName $pdce -FilterHashTable @{'LogName' ='Security';'Id' = 4740} ``` You are so much closer to finding those locked out users in Active Directory with PowerShell! ## Parsing the Username and Location This will return all of the lockout events but doesn’t immediately show the usernames and computers that the lockout was performed on. To find the username, you’ll need to dive in a little deeper on a property that `Get-WinEvent` returns called `Properties`. ```powershell $filter = @{'LogName' = 'Security';'Id' = 4740} $events = Get-WinEvent -ComputerName $pdce -FilterHashTable $filter $events | Select-Object @{'Name' ='UserName'; Expression={$_.Properties[0]}}, @{'Name' ='ComputerName';Expression={$_.Properties[1]}} ``` You can see that I’ve moved the hashtable filter to prevent code wrap and, more importantly, used `Select-Object`‘s calculated properties to pull the username and computer name from the `Properties` property. In each of these events, the username that was locked out is always the first element in the `Properties` array while the second element is always the computer name where the lockout was performed on. ## Leveraging PowerShell to Unlock AD Accounts Now that you have found your locked out AD users, how do you go about unlocking the accounts? The [`ActiveDirectory` module in PowerShell](https://docs.microsoft.com/en-us/powershell/module/activedirectory/?view=windowsserver2019-ps) offers the [`Unlock-ADAccount`](https://docs.microsoft.com/en-us/powershell/module/activedirectory/unlock-adaccount?view=windowsserver2019-ps) command making quick work of getting a customer back to work. As shown below, use PowerShell to unlock AD accounts. This command works in both Windows PowerShell and PowerShell 7, once loaded via the `ActiveDirectory` module. ```powershell Unlock-ADAccount -Identity 'lockeduser' ``` Perhaps you are looking to unlock all locked users at once, use the [`Search-ADAccount`](https://docs.microsoft.com/en-us/powershell/module/activedirectory/search-adaccount?view=windowsserver2019-ps) with the `-LockedOut` parameter and pipe the results to the `Unlock-ADAccount` command, as shown below. ```powershell Search-ADAccount -LockedOut | Unlock-ADAccount ``` > _Reduce service desk calls & update cache credentials for remote users even off VPN with a self-service password reset solution. [Get a Demo of Specops uReset!](https://specopssoft.com/contact-us/?utm_source=ata&utm_medium=referral&utm_campaign=na_ata&utm_content=mention)_ ## Summary ![Find Locked Out Users in Active Directory](https://adamtheautomator.com/wp-content/uploads/2022/08/Locked-Out-Users.jpg) Find Locked Out Users in Active Directory By now, you should be able to quickly pinpoint all of the accounts that are currently locked out in your domain as well as see a history of all account lockouts. Now it’s time to have a stern talking to Joe about leaving those RDP sessions open… Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Ffind-locked-out-users-in-active-directory-powershell%2F&text=How%20to%20Find%20Locked%20Out%20Users%20in%20Active%20Directory%20with%20PowerShell)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Ffind-locked-out-users-in-active-directory-powershell%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Ffind-locked-out-users-in-active-directory-powershell%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2024/11/image-23.png) ### [Managing Active Directory Groups with PowerShell: The Ultimate Guide](/powershell-ad-groups-guide/) Learn how to manage Active Directory groups with PowerShell! This hands-on guide shows you how to query, create and modify AD groups using practical real-world ![](https://adamtheautomator.com/wp-content/uploads/2019/08/database-152091_1280.png) ### [Active Directory Database: PowerShell Monitoring Made Easy](/active-directory-database/) Find the ntds.dit location and monitor your Active Directory database using PowerShell. ![](https://adamtheautomator.com/wp-content/uploads/2019/08/darknet-3588402_1280.jpg) ### [Master your LDAP Filters in PowerShell while Learning AD](/ldap-filter/) Learning how to use LDAP filter, how to filter with the Active Directory PowerShell cmdlets, and learn the right way to filter AD objects. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)