Active Directory Security Event Forensics: The Incident Response Query Playbook

The Event Log Bottleneck

During an active security incident or an executive account lockout, speed is everything. Yet, many systems administrators and Tier 2 analysts still approach Windows Event Logs with legacy command patterns:

# The Anti-Pattern: Slow, memory-heavy, and unindexed
Get-EventLog -LogName Security | Where-Object { $_.EventID -eq 4740 }

On a busy enterprise Domain Controller processing 5,000 authentications per minute, the Security event log frequently spans 20 GB to 40 GB across multiple wrapped EVTX archives. Piping every raw event object across the PowerShell pipeline forces the engine to deserialize millions of XML documents into memory. The query takes 15 minutes, pegs the DC’s CPU at 100%, and often crashes with an out-of-memory exception.

Think of querying Windows Event Logs like querying an enterprise SQL database: piping to Where-Object is the equivalent of running a table scan on an unindexed billion-row database. In contrast, XPath filtering via Get-WinEvent -FilterXml passes the query directly to the native Windows Event Log subsystem (wevtutil/kernel), evaluating conditions before bytes ever cross into user space.

High-Speed XPath XML Queries

XPath XML queries filter events at the provider level using the <QueryList> specification. A properly constructed XPath query can scan 500,000 security events on a Domain Controller in under two seconds.

The core anatomy of an optimized event query consists of two primary clauses: the System header (EventID, Channel, and TimeCreated) and the structured EventData payload:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4740) and TimeCreated[timediff(@SystemTime) <= 86400000]]]
    </Select>
  </Query>
</QueryList>

The timediff(@SystemTime) <= 86400000 directive instructs the kernel to ignore any event older than 24 hours (86,400,000 milliseconds), drastically reducing disk I/O.

Hunting Account Lockouts (4740)

When an Active Directory user account locks out repeatedly, simply running Unlock-ADAccount is a temporary band-aid. Within seconds, whatever background process, stale network mapping, mobile ActiveSync profile, or scheduled task holds the bad password will trigger another failure and lock the account again.

Event ID 4740 is generated on the Domain Controller holding the PDC Emulator role (or the DC that processed the lockout threshold). The key to permanent resolution lies in extracting the CallerComputerName attribute:

Here is the production PowerShell script generated by the Forensic Query Builder to isolate the caller immediately:

# Fast Account Lockout Caller Discovery via FilterXml
$FilterXml = @'
<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">
      *[System[(EventID=4740) and TimeCreated[timediff(@SystemTime) <= 86400000]]]
    </Select>
  </Query>
</QueryList>
'@

$Events = Get-WinEvent -FilterXml $FilterXml -ErrorAction SilentlyContinue

$Events | Select-Object TimeCreated,
  @{N='LockedUser';E={$_.Properties[0].Value}},
  @{N='CallerDevice';E={$_.Properties[1].Value}},
  @{N='DomainController';E={$_.MachineName}} | Format-Table -AutoSize

The Event 4625 SubStatus Decoder

Event ID 4625 is logged whenever an authentication attempt fails. However, looking only at the event message “An account failed to log on” does not explain why. The diagnostic truth is embedded inside the SubStatus hex code.

Our forensic query builder incorporates the complete NTSTATUS failure decoder table:

DCSync (4662) & Kerberoasting (4769)

Beyond operational lockouts, high-speed event queries are critical for detecting advanced threat actors moving laterally inside an Active Directory domain:

Importing XML into Event Viewer

If you prefer working inside the standard Windows Event Viewer GUI (eventvwr.msc) rather than PowerShell, the Forensic Query Builder allows you to create permanent custom views in 30 seconds:

1. Open Event Viewer (eventvwr.msc) on any Domain Controller or management workstation.
2. In the left tree view, right-click Custom Views and click Create Custom View…
3. In the Create Custom View dialog, click the XML tab at the top right.
4. Check the box Edit query manually and click Yes when prompted.
5. Copy the XML query from the Forensic Query Builder and paste it into the editor.
6. Click OK and name your view (e.g. AD Lockout Origin Hunter).

Final Thoughts & SOC Integration

High-performance event log forensics bridges the gap between raw telemetry and actionable incident containment. By leveraging pre-compiled XPath filters and automated PowerShell objects, you eliminate the overhead of manual log reviews and pinpoint root causes in seconds.

To generate custom queries for your environment, launch the live Active Directory & Windows Security Event Query Builder. To audit and harden the network perimeter protecting these Domain Controllers, explore our companion Active Directory & Infrastructure Firewall Matrix Guide or visit the central Tools Directory.