How to Find What Caused an Active Directory Account Lockout (PowerShell Script)

Get-WinEvent -ComputerName <DC-name> -FilterHashtable @{LogName='Security'; Id=4740} |
    Select-Object TimeCreated, @{N='User';E={$_.Properties[0].Value}}, @{N='Source';E={$_.Properties[1].Value}}

#requires -Modules ActiveDirectory
<#
.SYNOPSIS
    Finds the source (computer) that caused an Active Directory account lockout.

.DESCRIPTION
    Searches the Security event log on every domain controller for Event ID
    4740 (account lockout events), which records the computer the bad
    password attempts actually came from — the PDC emulator itself is where
    lockouts are ultimately processed, but 4740 on it names the origin host.
    Uses the current logged-on user's credentials; you need permission to
    read the Security event log on each DC (typically Domain Admins, or
    delegated log-reading rights).

.PARAMETER SamAccountName
    Only show lockout events for this user. If omitted, shows lockout events
    for all users.

.PARAMETER Hours
    How far back to search, in hours. Defaults to 24.

.PARAMETER OutputCsv
    Path to a CSV file to export the results to. If omitted, results are only
    written to the console.

.EXAMPLE
    .\Get-ADAccountLockoutSource.ps1 -SamAccountName jdoe

    Shows lockout events for jdoe in the last 24 hours, including which
    computer triggered each one.

.EXAMPLE
    .\Get-ADAccountLockoutSource.ps1 -Hours 72 -OutputCsv .\lockouts.csv

    Shows lockout events for all users in the last 3 days and exports to CSV.
#>

[CmdletBinding()]
param(
    [string]$SamAccountName,

    [int]$Hours = 24,

    [string]$OutputCsv
)

Import-Module ActiveDirectory -ErrorAction Stop

$domainControllers = Get-ADDomainController -Filter *
$startTime = (Get-Date).AddHours(-$Hours)
$results = New-Object System.Collections.Generic.List[object]

foreach ($dc in $domainControllers) {
    Write-Host "Checking $($dc.HostName) for lockout events since $startTime ..." -ForegroundColor Cyan

    $filterHashtable = @{
        LogName   = 'Security'
        Id        = 4740
        StartTime = $startTime
    }

    try {
        $events = Get-WinEvent -ComputerName $dc.HostName -FilterHashtable $filterHashtable -ErrorAction Stop
    } catch [Exception] {
        if ($_.Exception -is [System.Diagnostics.Eventing.Reader.EventLogNotFoundException]) {
            Write-Verbose "No lockout events found on $($dc.HostName) in the given window."
            continue
        }
        Write-Warning "Could not query $($dc.HostName): $($_.Exception.Message)"
        continue
    }

    foreach ($event in $events) {
        $targetUser = $event.Properties[0].Value
        if ($SamAccountName -and $targetUser -ne $SamAccountName) {
            continue
        }

        $results.Add([PSCustomObject]@{
            TimeCreated       = $event.TimeCreated
            LockedOutUser     = $targetUser
            SourceComputer    = $event.Properties[1].Value
            RecordedOnDC      = $dc.HostName
        })
    }
}

if ($results.Count -eq 0) {
    Write-Host "No lockout events found in the last $Hours hour(s)." -ForegroundColor Yellow
    return
}

$sorted = $results | Sort-Object TimeCreated -Descending

Write-Host "Found $(@($sorted).Count) lockout event(s)." -ForegroundColor Cyan
$sorted | Format-Table TimeCreated, LockedOutUser, SourceComputer, RecordedOnDC -AutoSize

if ($OutputCsv) {
    $sorted | Export-Csv -Path $OutputCsv -NoTypeInformation
    Write-Host "Exported results to $OutputCsv" -ForegroundColor Green
}