Releasing an account that was locked by a brute-force attempt.
What gives it awayAn unlock shortly after a lockout, followed by more failures, which suggests the guessing is continuing.
ATT&CK T1110Windows Security Log · Event 4767
Event 4767: A user account was unlocked
A locked account was released, either by an administrator or by the lockout duration expiring. On its own it is administrative housekeeping — its value is as the closing bracket on a lockout, and as a way to spot accounts that lock again minutes later.
Also written as Event ID 4767A user account was unlocked4767 account unlocked
- How oftenUncommon
- Vendor calls itAudit Success
- LogSecurity
- SourceMicrosoft-Windows-Security-Auditing
What it means for you
On a personal computer
An account that was temporarily blocked has been released and can sign in again.
For an analyst
An account unlocked and locked again within minutes means the stale credential was never found — the unlock is treating the symptom. Count unlock-relock cycles per account; the worst offenders are almost always a service or a mobile mail client.
What it looks like
Sanitised. Addresses come from the RFC 5737 documentation ranges.
A user account was unlocked.
Subject:
Security ID: CORP\helpdesk01
Account Name: helpdesk01
Account Domain: CORP
Logon ID: 0x3E9A11
Target Account:
Security ID: CORP\jbrooks
Account Name: jbrooks
Account Domain: CORPThe fields that decide it
Everything else in the log line is context.
- TargetUserName
- The account that was unlocked.
- SubjectUserName
- Who unlocked it. On a domain controller this may be the DC's own computer account when the lockout duration simply expired.
- SubjectLogonId
- The session that performed the unlock.
Ordinary reasons this happens
Most of the time it is one of these.
- A help desk releasing an account after a user was locked out.
- The lockout duration expiring, which releases the account automatically.
- Self-service unlock tooling.
- An administrator clearing a lockout caused by a known stale credential.
When it is not ordinary
Social engineering the help desk.
What gives it awayAn unlock performed after an unverified request, particularly for a privileged account.
ATT&CK T1078What to do next
- Find the matching 4740 to see what locked the account.
- Check whether the account locked again shortly after being unlocked.
- Count unlock cycles per account over a week — repeat offenders have an unfixed stored credential.
- For privileged accounts, confirm the unlock request was verified before it was actioned.
Queries to run
SecurityEvent | where EventID == 4767 | summarize unlocks = count() by TargetUserName | where unlocks > 3 | order by unlocks descSecurityEvent | where EventID in (4740, 4767) | project TimeGenerated, EventID, TargetUserName | order by TargetUserName, TimeGenerated ascCommon questions
Why does my account lock again right after being unlocked?
Because something is still offering the old password automatically. Unlocking treats the symptom; the cause is usually a Windows service or scheduled task running under the account, a phone collecting mail, a mapped drive, or a saved credential. Read the caller computer name in the matching Event 4740 to find where the attempts come from.
Does Windows unlock accounts automatically?
It does if a lockout duration is configured — the account is released once that time passes, without anyone doing anything. If the duration is set to zero, the account stays locked until an administrator releases it.
Read next
- Usually comes before Event 4740: A user account was locked out The lockout this releases. Read that one for the caller computer name.
- Usually comes before Event 4625: An account failed to log on The failed sign-ins that caused the lockout.
- Usually comes after Event 4624: An account was successfully logged on The successful sign-in after the account was released.
- Read alongside Event 4724: An attempt was made to reset an account's password A password reset, often performed at the same time.
Vendor documentation
Last reviewed 28 August 2026