User Lockout Log Events

[hawley35]

I can't seem to find any logs for User Lockout events. We get email notifications of the events, but they don't appear in any of the logs. I'd expect them to be in the Activity Logs, or Authentication logs.

Does anyone know where to find these events?

[balaji.bandi]

User Lockout ? AD users ?

[hawley35]

Duo user lockout. https://duo.com/docs/administration-settings#lockout-and-fraud

It is an action taken by the Duo system on Duo user objects, it should be logged.

[DuoKristina]

The actual lockout event isn't logged in the authentication log (I think you are looking for a system event locking the user out).

You'll see the repeated auth failures that led up to the account lockout, and then on the user's next login attempt the authentication log will show it failed because the user is locked out.

Sample: 10 failed passcode auths locked the user; the 11th try fails due to lockout.