How to track the source machine of frequent failed logon attampt?

[Guest Mark]

We are running windows 2003 shop. One user account is getting lock out every

5 minutes. I suspect some program is trying to log on to the network

internally with the user name and password. I guess security log from DC

will reveal the failed login attempt. But how can I trace to the source of

this failed attampt?

[Guest Ryan Hanisco]

RE: How to track the source machine of frequent failed logon attampt?

 

Hi Mark,

 

You may want to look at the account lockout tools.

 

http://www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e

 

--

Ryan Hanisco

MCSE, MCTS: SQL 2005, Project+

http://www.techsterity.com

Chicago, IL

 

Remember: Marking helpful answers helps everyone find the info they need

quickly.

 

 

"Mark" wrote:

> We are running windows 2003 shop. One user account is getting lock out every

> 5 minutes. I suspect some program is trying to log on to the network

> internally with the user name and password. I guess security log from DC

> will reveal the failed login attempt. But how can I trace to the source of

> this failed attampt?