Mass account lockouts hitting the domain right now, hundreds of users locked out

Hi Li Jia Hao INC,

Mass account lockouts can be disruptive, and the key is to isolate the source as fast as possible. The most effective toolset we recommend is the Microsoft Account Lockout and Management Tools package, which includes utilities like LockoutStatus.exe. This lets you trace which domain controller is processing the bad logon attempts and helps identify the originating machine or service.

In addition, enabling auditing for failed logons and reviewing the Security Event Logs on your domain controllers can help confirm whether the issue is cached credentials, a misconfigured service account, or a brute-force attempt. For brute-force scenarios, pairing this with Azure AD Identity Protection or Defender for Identity can give you real-time alerts and correlation. If you suspect a service account, check scheduled tasks, mapped drives, or old scripts that may still be using outdated passwords.

Another practical step is to use the Netlogon logs (by enabling debug logging) to trace authentication attempts at the protocol level. This often pinpoints the exact client or process causing repeated failures. Once identified, you can remediate by resetting credentials, disabling the offending service, or blocking malicious IPs.

Jason.