| Event Id | 539 |
| Source | Security |
| Description | Logon Failure: Reason: Account locked out User Name: <User Name> Domain: <Domain> Logon Type: <Logon Type> Logon Process: <Logon Process> Authentication Package: <Authentication Package> Workstation Name:<Workstation Name> |
| Event Information | Cause: A logon attempt was made and rejected because the account has been locked out. An account gets locked out after the number of unsuccessful logon attempts exceeds the preset limit established in the domain policy. Resolution: The administrator must re-enable the account. |
| Reference Links | Tracking Logon and Logoff Activity in Windows 2000 (Article) Alternate Event ID in Vista and Windows Server 2008 is 4625. Tracking Logon and Logoff Activity in Windows 2000 |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.