~/ KARANTH.OVH // FORENSIC UTILITY

Active Directory & Windows Security Event Query Builder

Production-tested Event Viewer XPath queries, high-performance PowerShell scripts, and SubStatus error code decoders for incident response, account lockouts, DCSync attacks, and privilege tracking.

Need a step-by-step investigation playbook on hunting lockouts and decoding Event 4625 SubStatus codes? Read Forensics Playbook →
LOG: Security • EVENT ID: 4740 • SEVERITY:
Critical Forensic Data Fields
XML Property Name Operational Meaning Investigation Significance
SubStatus & Failure Code Decoders
Hex / Status Code Constant Definition Root Cause Diagnostic
Handcrafted for enterprise infrastructure & SOC engineers • Karanth.ovh • Production-tested field manuals.