topic User Lockout Log Events in Managing Users

User Lockout Log Events

hawley35 — Mon, 28 Aug 2023 16:06:06 GMT

I can't seem to find any logs for User Lockout events. We get email notifications of the events, but they don't appear in any of the logs. I'd expect them to be in the Activity Logs, or Authentication logs.

Does anyone know where to find these events?

Re: User Lockout Log Events

balaji.bandi — Mon, 28 Aug 2023 20:20:29 GMT

User Lockout ? AD users ?

Re: User Lockout Log Events

hawley35 — Tue, 29 Aug 2023 13:20:12 GMT

Duo user lockout. https://duo.com/docs/administration-settings#lockout-and-fraud

It is an action taken by the Duo system on Duo user objects, it should be logged.

Re: User Lockout Log Events

DuoKristina — Tue, 29 Aug 2023 23:09:15 GMT

The actual lockout event isn't logged in the authentication log (I think you are looking for a system event locking the user out).

You'll see the repeated auth failures that led up to the account lockout, and then on the user's next login attempt the authentication log will show it failed because the user is locked out.

Sample: 10 failed passcode auths locked the user; the 11th try fails due to lockout.