Mass local Administrator lockout/reset across hosts via GPO

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•7

Detects a cluster of Windows Event IDs 4740 (Account Lockout) or 4724 (Password Reset) targeting the local 'Administrator' account across multiple hosts within a short time window. This activity is indicative of automated or mass account manipulation often associated with ransomware payloads or centralized GPO-based credential tampering.