Windows

Use events 4740 and 4625 together to move from 'the account keeps locking' to a timeline that identifies the source device, logon type and stale credential.

When a local script is blocked by execution policy, Process scope can be useful for a temporary session without changing the machine-wide setting.