Account lockouts and where they came from (event 4740)

#Requires -RunAsAdministrator
# Account lockouts (event 4740) in a Security log, with the caller computer. Read-only.
param(
    [int]$Hours = 24,
    [string]$ComputerName = 'localhost'
)

$filter = @{ LogName = 'Security'; Id = 4740; StartTime = (Get-Date).AddHours(-$Hours) }
$events = @(Get-WinEvent -ComputerName $ComputerName -FilterHashtable $filter -ErrorAction SilentlyContinue)
if ($events.Count -eq 0) {
    Write-Output "No event 4740 on $ComputerName in the last $Hours hours (or account management auditing is off)."
}

$lockouts = foreach ($record in $events) {
    $data = @{}
    foreach ($item in ([xml]$record.ToXml()).Event.EventData.Data) { $data[$item.Name] = $item.'#text' }
    [pscustomobject]@{
        TimeCreated    = $record.TimeCreated
        Account        = $data['TargetUserName']
        CallerComputer = $data['TargetDomainName']
        LoggedBy       = $data['SubjectUserName']
        AccountSid     = $data['TargetSid']
    }
}
$lockouts | Sort-Object TimeCreated -Descending

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

A domain controller for domain accounts, or the device itself for local accounts, in an elevated Windows PowerShell 5.1 session. Pass -ComputerName to read another computer's Security log remotely.

Reading the output

• Reads each event's named fields. Per Microsoft's event 4740 reference, the Caller Computer Name (the computer the failed attempts came from) is carried in the TargetDomainName field, as in its example where it holds WIN81.
• Event 4740 is written only when the Audit User Account Management subcategory is audited. An empty result can mean auditing is off.
• The caller computer is often a device with an old saved password (a mapped drive, a phone, a scheduled task or a service). That is the place to look before unlocking the account again.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.