# Create a kibana dashboard for user account lockouts
**URL:** https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463
**Category:** Kibana
**Created:** [July 27, 2023, 4:54pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463 "2023-07-27T16:54:40Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@kibana\_user17](https://discuss.elastic.co/u/kibana_user17)
#### Post date: [July 27, 2023, 4:54pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/1 "2023-07-27T16:54:40Z")
Hi everyone. i'm very new to elasticsearch. Is it possible to create a dashboard in Kibana showing user account lockouts? If so, how? We used winlogbeat and elasticsearch. Appreciate the help..
---
### Author:  [@grfneto](https://discuss.elastic.co/u/grfneto)
#### Post date: [July 27, 2023, 5:41pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/2 "2023-07-27T17:41:27Z")
Hi @kibana_user17
To better understand, blocked users you want to get in dashboard is from kibana? or Active Directory Users?
Best regards.
---
### Author:  [@kibana\_user17](https://discuss.elastic.co/u/kibana_user17)
#### Post date: [July 27, 2023, 5:59pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/3 "2023-07-27T17:59:33Z")
Active Directory users. So, it's either disabled user accounts or user account lockouts.
---
### Author:  [@grfneto](https://discuss.elastic.co/u/grfneto)
#### Post date: [July 27, 2023, 6:09pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/4 "2023-07-27T18:09:37Z")
Hi @kibana_user17
In the winlogbeat settings you can filter the AD events that report this block. From there winlogbeat will ingest into elasticsearch and you will be able to create a dashboard in kibana.
I recommend reading the link below, about Sysmon for metrics enrichment:
[Sysmon Module | Winlogbeat Reference [8.9] | Elastic](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-module-sysmon.html)
---
### Author:  [@kibana\_user17](https://discuss.elastic.co/u/kibana_user17)
#### Post date: [July 27, 2023, 6:46pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/5 "2023-07-27T18:46:49Z")
Update: Sysmon module is in fact enabled. However, I can't see any users account lockout events in Kibana?
What if Sysmon module is not enabled or being used? Is it possible to just used the filter event.code:"4740" for account lockouts?
---
### Author:  [@grfneto](https://discuss.elastic.co/u/grfneto)
#### Post date: [July 27, 2023, 10:19pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/6 "2023-07-27T22:19:11Z")
Yes. You can filter the event code using KQL, through the discover module. Below is a print as an example:
---
### Author:  [@kibana\_user17](https://discuss.elastic.co/u/kibana_user17)
#### Post date: [July 28, 2023, 11:05am UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/7 "2023-07-28T11:05:37Z")
Hi. Thank you. I've tried using the event.code:"4740" and didn't see any result. Yesterday, one of our admin account was locked and that event didn't show in our logs (kibana discovery).
---
### Author:  [@kibana\_user17](https://discuss.elastic.co/u/kibana_user17)
#### Post date: [July 28, 2023, 1:43pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/8 "2023-07-28T13:43:30Z")
Update: I've tested it today and didn't see any event id of 4740. However, I saw event id 4625 and 4776 regarding the account lockout. For the event code 4625, it's registered as event.action: Account Lockout and event.outcome: Failure. While event.code: 4776, it has event.action: Credential Validation and event.outcome: Failure. These logs happened after I tried to login again knowing that my account is already locked. Unfortunately, I didn't see any logs about account lockout when it actually happened. Does this make sense?
---
### Author:  [@dawn](https://discuss.elastic.co/u/dawn)
#### Post date: [July 28, 2023, 7:22pm UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/9 "2023-07-28T19:22:41Z")
While I am a beginner myself in this area, here is how I would troubleshoot:
1. Does the windows native system log register the lockout event, i.e. in the windows logs that elasticsearch picks up?
2. If not, perhaps the windows system is not configured to log the lockout event and write it to the native system log.
3. If the native windows system log contains the event, perhaps the issue is somewhere in the winlogbeat configuration
---
### Author:  [@kibana\_user17](https://discuss.elastic.co/u/kibana_user17)
#### Post date: [July 31, 2023, 11:07am UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/10 "2023-07-31T11:07:15Z")
Hi Dawn,
Thank you for the response.
We have an event collector server which is where winlogbeat is installed and running. There is a subscription setup from the domain controllers and the event collector server for the forwarded logs. On the domain controllers, I can see the account lockout (4740) event. I can also see the account lockout event on the event collector under event viewer \> Applications and Services Logs \> Domain Controllers \> Security logs. Finally, I found out last Friday that I'm not seeing Security logs from our DC. It shows our event collector server as the host and not the DCs every time someone logs in to the DCs. It is possible that the winlogbeat configuration is the issue.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2023, 11:07am UTC](https://discuss.elastic.co/t/create-a-kibana-dashboard-for-user-account-lockouts/339463/11 "2023-08-28T11:07:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.