How do I find what caused the lockout?

Domain controllers log event 4740 for each lockout, including the Caller Computer Name — the machine the bad attempts came from. Look at the 4625 and 4771 events from that machine just before the lockout to see the process, logon type and source address responsible, and check the services, tasks and saved credentials on it.

Does a locked account mean the password was guessed?

No. A lockout means enough wrong passwords arrived to cross the threshold; nothing was accepted. Check whether a successful logon (event 4624) for the account followed from the same source once the lockout ended — that, not the lockout itself, is the sign of compromise.

Why does one user keep getting locked out?

The most common cause is a device or service still using an old password after a change: a phone syncing mail, a mapped drive, a saved RDP credential or a scheduled task. The Caller Computer Name in event 4740 points at it. Repeated lockouts from an unknown host or an external address are an attack.

Can attackers lock accounts on purpose?

Yes. Crossing the threshold for many accounts denies those users access, and a very low lockout threshold makes that cheap to do. Bursts of lockouts across many accounts at once should be handled as an incident in their own right, even when no logon succeeded.

0xC0000234: Windows Account Locked Out — Find the Source

Published October 6, 2026

The account is locked because the lockout threshold was reached; every further attempt fails with this code until the lockout ends or an administrator unlocks it.

Did the attacker have the password? Cannot tell from this code alone — correlate with the events around it.

Microsoft's definition

STATUS_ACCOUNT_LOCKED_OUT

The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested.

Source: [MS-ERREF] NTSTATUS Values · checked against the published table on every build

Where it appears

Event 4625 (An account failed to log on): the Status field, with Failure Reason "Account locked out"
Event 4740 (A user account was locked out) on domain controllers: records the lockout itself and the Caller Computer Name
Microsoft Sentinel / Log Analytics: the Status column of the SecurityEvent table

What it means

0xC0000234 — STATUS_ACCOUNT_LOCKED_OUT — appears in the Status field of event 4625 (with the Failure Reason “Account locked out”) once an account has crossed the domain or local lockout threshold. From then until the lockout duration expires or an administrator unlocks the account, every logon attempt fails with this code, whether the password is right or wrong.

The lockout itself is recorded once, by event 4740 on domain controllers. That event names the locked account and the Caller Computer Name, the machine the failed attempts came from — the single most useful field for finding the cause.

Is it an attack?

Pattern	Reading
One user, repeated lockouts, caller is their own phone or laptop	A stale password on a device after a password change
A service or admin account, caller is an application server	Old credentials in a service, scheduled task or script
Many accounts locked within minutes from one caller	Password spraying or brute force crossing the threshold
Lockouts on admin accounts from an internet-facing host	Exposed RDP or SMB under attack

Lockouts are usually preceded by a run of 0xC000006A for the same account; if the run includes 0xC0000064 for other names from the same source, it is a spray.

How to investigate

List the lockouts and the machines that caused them. In the SecurityEvent table, event 4740 stores the Caller Computer Name in the TargetDomainName column:

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4740
| project TimeGenerated, LockedAccount = TargetUserName, CallerComputer = TargetDomainName, DomainController = Computer
| order by TimeGenerated desc

Then look at the failures that ran into the lock, grouped by source:

SecurityEvent
| where TimeGenerated > ago(1d)
| where EventID == 4625 and (Status =~ "0xc0000234" or SubStatus =~ "0xc000006a")
| summarize Failures = count(), LockedOutAttempts = countif(Status =~ "0xc0000234"),
            Accounts = make_set(TargetUserName, 20)
    by IpAddress, WorkstationName
| order by LockedOutAttempts desc, Failures desc

Fix stale credentials on the caller when it is one of your own devices. When the caller is unknown or external, block it, check that no 4624 success for the locked accounts followed from the same source, and review the Windows 4625 password-spray rule for ongoing detection.

Related codes

0xC000006A STATUS_WRONG_PASSWORD The account exists and the password was wrong. One event is a typo; many against one account is brute force; one source failing across many real accounts is password spraying.
0xC0000064 STATUS_NO_SUCH_USER Someone tried to log on with an account name that does not exist. Occasional typos are normal; bursts of invented names from one source are username guessing or spraying with a generic list.
0xC000006D STATUS_LOGON_FAILURE The logon was rejected as invalid without saying which half was wrong — it is the general failure result that event 4625 usually carries in Status, with the real reason in Sub Status.
0xC0000072 STATUS_ACCOUNT_DISABLED

Frequently Asked Questions

How do I find what caused the lockout?: Domain controllers log event 4740 for each lockout, including the Caller Computer Name — the machine the bad attempts came from. Look at the 4625 and 4771 events from that machine just before the lockout to see the process, logon type and source address responsible, and check the services, tasks and saved credentials on it.
Does a locked account mean the password was guessed?: No. A lockout means enough wrong passwords arrived to cross the threshold; nothing was accepted. Check whether a successful logon (event 4624) for the account followed from the same source once the lockout ended — that, not the lockout itself, is the sign of compromise.
Why does one user keep getting locked out?: The most common cause is a device or service still using an old password after a change: a phone syncing mail, a mapped drive, a saved RDP credential or a scheduled task. The Caller Computer Name in event 4740 points at it. Repeated lockouts from an unknown host or an external address are an attack.
Can attackers lock accounts on purpose?: Yes. Crossing the threshold for many accounts denies those users access, and a very low lockout threshold makes that cheap to do. Bursts of lockouts across many accounts at once should be handled as an incident in their own right, even when no logon succeeded.

Find 0xC0000234 in your own logs

Load a Windows Security event export into the free browser analyzer to group failures by account, source IP and status code (nothing is uploaded), or run it through LogTriage for threat-intel enrichment and an AI-written incident report.

Open the free analyzer → Analyze Your Own Logs