What you’ll notice: Users are getting locked out after entering the wrong password multiple times. You may see Event ID 4740.
Why it happens:
- Old saved passwords on phones or PCs
- Disconnected shared drives still trying to reconnect
- Remote Desktop (RDP) sessions with bad credentials
How to fix it:
- Use tools like LockoutStatus or Event Viewer to find the device causing the lockout
- Clear saved credentials on the user’s devices
- Reset the user’s password
- Remind users not to save old passwords across devices
