List all locked out accounts

Accounts can be locked out for many different reasons. The user might have forgotten the password, the password might have been changed but services on other machines are still using the old password and so forth. Another reason, and the reason you should fear the most, is that someone is trying to break in. Hence we want to keep an eye out if there is any accounts that keep getting locked out.

The LDAP query to list all locked out accounts look like this: (&(&(&(objectCategory=person)(objectClass=user)(lockoutTime:1.2.840.113556.1.4.804:=4294967295)))) Just copy/paste the query string above into your favourite LDAP browser and you should get the list of locked out accounts. Check this out to get more info from Active Directory!