Finding bad password attempts in Active Directory

Short answer Check the user object for the latest bad-password time, then use Security event 4740 on the domain controller to identify the actual lockout source.

Requirements

A management device with the Active Directory PowerShell module
Permission to read the user object and Security log
The correct sign-in name of the affected user

Check the latest bad-password attempt

# Replace the username for your environment
$User = "EXAMPLE.USER"

Get-ADUser $User -Properties badPwdCount,badPasswordTime,LockedOut |
Select-Object SamAccountName, LockedOut, badPwdCount,
@{Name="LastBadPasswordTime";Expression={
  if ($_.badPasswordTime -gt 0) {
    [datetime]::FromFileTime($_.badPasswordTime)
  }
}}

How to read the output

LockedOut shows whether the account is currently locked, badPwdCount is the failed-attempt count on that domain controller, and SonYanlisParolaZamani shows the time of the latest attempt.

Find the device causing the lockout

Run this in an elevated PowerShell session on the domain controller that recorded the lockout.

# Find the device that triggered the lockout
$User = "EXAMPLE.USER"

Get-WinEvent -FilterHashtable @{
  LogName = "Security"
  Id      = 4740
} -ErrorAction SilentlyContinue |
Where-Object { $_.Properties[0].Value -eq $User } |
Select-Object -First 10 TimeCreated,
@{Name="User";Expression={$_.Properties[0].Value}},
@{Name="CallerComputer";Expression={$_.Properties[1].Value}}

CallerComputer identifies the computer or server sending the stale password. Check saved credentials, scheduled tasks, services, Outlook, mobile devices and VPN connections on that device.

Important note

badPwdCount can differ between domain controllers and is not definitive by itself. Use event 4740 and its timestamp as the primary evidence. An empty result may mean you queried the wrong server or the event has already aged out.

Search every domain controller

If you do not know which DC recorded event 4740, query the last 24 hours across all DCs. Use a shorter window in large environments.

# Search event 4740 on every DC for the last 24 hours
$User = "ORNEK.KULLANICI"
Get-ADDomainController -Filter * | ForEach-Object {
  $DC = $_.HostName
  Get-WinEvent -ComputerName $DC -FilterHashtable @{
    LogName="Security"; Id=4740; StartTime=(Get-Date).AddHours(-24)
  } -ErrorAction SilentlyContinue |
  Where-Object { $_.Properties[0].Value -eq $User } |
  Select-Object TimeCreated,
    @{N="DomainController";E={$DC}},
    @{N="CallerComputer";E={$_.Properties[1].Value}}
} | Sort-Object TimeCreated -Descending