Can you tell me how can i check the AD account lockout events in Log Insight

[gpgupta7891]

Hello,

Can you tell me how can i check the AD account lockout events in Log Insight.

Thank you

[daphnissov]

First is to install the Log Insight agent on your AD servers and to download, install, and configure the Active Directory content pack along with agent groups. Have you done that first?

[gpgupta7891]

Thank you for your response. This was setup by someone else so i think it should already be in place. Can you let me know how can i check the events in log insight.

[daphnissov]

Go under 'Agents' and see if you see your AD servers in there to begin with.

[gpgupta7891]

Thank you. This is now resolved, I have searched for the event id 4740 and can se the account lockout events.