What does Windows event ID 4740 indicate?

Event ID 4740 is a security audit event in Windows that indicates a user account has been locked out. This event is generated every time the system locks out a user account due to repeated logon failures, which are typically caused by incorrect password entries. The event is logged on domain controllers, member servers, and workstations where the lockout occurred. It includes details such as the account name, domain, and the computer from which the lockout originated.

References: The information is verified as per Microsoft’s official documentation and learning resources related to security auditing and user account management. Specifically, the Microsoft Learn page on security auditing provides comprehensive details on Event ID 47401. Additionally, resources like Ultimate Windows Security offer in-depth explanations of this event and its implications for security monitoring2.