How to Track Users With Bad Password Attempts in Active Directory

In Active Directory, users may repeatedly fail to log in due to incorrect passwords, and these attempts are recorded by the domain controller. Simply tracking affected users is not enough; auditing exact failed logon events is crucial. Detailed event logs help admins investigate primary causes like incorrect passwords, forgotten passwords, potential attacks, and more. This enables quick action to secure accounts and maintain a safe environment.

Monitor the bad password attempts of Active Directory users in the Event Viewer

Now, from the list of login failures due to bad password attempts, click on an event to investigate details such as the account name, logged time, logon type, and more.

Audit bad password attempts in Active Directory using PowerShell

While Event Viewer helps check bad password attempts on a single machine, it becomes time-consuming across multiple DCs. To overcome this limitation, PowerShell offers a faster, scalable way to retrieve these logs.

Execute the script below in every domain controller to get all bad password attempts of users in your Active Directory.

$results = foreach ($dc in (Get-ADDomainController -Filter * | Select-Object -ExpandProperty HostName)) {
    Get-WinEvent -ComputerName $dc -FilterHashtable @{LogName='Security'; ID=4625} |
    Where-Object { $_.Properties[9].Value -eq "0xC000006A" } |
    Select-Object TimeCreated, 
        @{Name='User'; Expression = { $_.Properties[5].Value } }, 
        @{Name='Computer'; Expression = { $_.MachineName } }
}
$results

• With the invalid login attempts report, you can filter all login failures due to bad password attempts using the Failure Sub Status filter.
• It also includes details such as logon time, logon username, event ID, failure reason, failure sub status, and more.

Sometimes users get locked out of their Active Directory accounts after just a few incorrect password attempts, which often happens when passwords are forgotten. This can happen when the account lockout threshold is set too low. However, a threshold that is too high may open the door for attackers, so admins need to balance security and usability by adjusting it in Group Policy.

Set bad password threshold in Active Directory with GPMC

Note: The default domain policy applies these settings to all computers in the domain. To target specific computers with different policies, you can create separate GPOs and link them to the respective OUs.

Modify account lockout threshold with Active Directory PowerShell

PowerShell offers a quicker way to set the account lockout threshold without navigating through GPMC by directly accessing the GPO.

Note: You can set values above 999 (up to 65,535) using PowerShell, but a threshold of 10 attempts is recommended for balanced security and user experience.

A computer in Active Directory can cause account lockouts due to misconfigured services, malware, or incorrect passwords. An increasing bad password count often signals issues like synchronization delays, cached credentials, or replication problems.

These issues should not be ignored, as they can compromise network security and impact overall system performance. As an admin, you need to monitor the bad password count for a computer to quickly resolve these types of problems and strengthen Active Directory security.

Monitor the bad password count for the computer in ADUC

Track the bad password count for the computer using PowerShell

Run the following cmdlet after replacing the <ComputerName> with the actual computer name to get its bad password count.

Get-ADComputer -Identity <ComputerName> -Properties badPwdCount | Select-Object Name, badPwdCount

To list all bad passwords attempted computers, you can use the following cmdlet.

Get-ADComputer -Filter {badPwdCount -ge 1} -Properties badPwdCount | Select-Object Name, badPwdCount

Imagine an employee repeatedly fails to log in to their account. Some attempts happen because of mistyped passwords, while others may indicate a brute-force or targeted attack. IT admins must examine the source, time, and frequency of failed logons to identify the cause. Accurate analysis helps protect accounts without causing unnecessary disruptions in your organization.

The following table summarizes key factors to differentiate between simple user errors and potential attacks for helping admins quickly identify suspicious activity in Active Directory.