What is an account-lockout event?¶

An account-lockout event records that a system temporarily or permanently prevented an account from authenticating.

This often happens after repeated failed login attempts or because of a security policy.

Avoid the dangerous assumption¶

The dangerous assumption is that an account lockout proves an attacker repeatedly guessed the password.

It may not.

Lockouts can be caused by a user forgetting a password, a device retaining old credentials, a service account using an expired password or several applications attempting authentication automatically.

The event may include the account, lockout reason, threshold, source address, device, triggering event and timestamp. It can help establish when access was restricted and what activity preceded it.

But some systems record the source of the final failure only, not every earlier attempt. A shared account may also receive failures from several devices or services.

Investigators should obtain the lockout policy and reason code. Ask how many failures were required, over what period and whether the account unlocked automatically or required administrator action.

Preserve the preceding failed logins, successful logins, device details and administrator records. Patterns across accounts, addresses and time may help distinguish stale credentials from deliberate password attacks.

Do not assume that the account holder was present or aware of the failures. Equally, do not dismiss repeated lockouts without checking whether they form part of wider hostile activity.

Operational takeaway¶

An account-lockout event shows that a security threshold or policy restricted access, but the cause may be user error, automation, stale credentials or hostile attempts and must be established from surrounding evidence.