You can use this [[PowerShell]] command to view [[Windows Active Directory (AD)|Active Directory]] account lockouts in the past 7 days.
```PowerShell
$startTime = (Get-Date).AddDays(-7)
Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4740)]]" | Where-Object { $_.TimeCreated -ge $startTime } | ForEach-Object {
[PSCustomObject]@{
TimeCreated = $_.TimeCreated
User = $_.Properties[0].Value
SourceComputer = $_.Properties[1].Value
}
} | Format-Table -AutoSize
```