User Account Locked Out

Detects user accounts that are currently locked out. Locked out accounts can indicate repeated failed authentication attempts, password spray activity, or accounts that require administrative review before access is restored.

Recommended Actions

Investigate whether the lockout was caused by user error, stale credentials, or suspicious authentication activity. If compromise is suspected, reset or rotate the password before unlocking the account. Review affected systems and cached credentials that may still be attempting to authenticate with old passwords.

Compatibility

Microsoft Active Directory