Guest Scott W Posted February 8, 2008 Posted February 8, 2008 Hello ... I have a domain with 7 DCs - I have an Admin who has not been able to use his account since the last time he changed his password. I've poured over NETLOGON logs and SECURITY event logs and something is running on 2 of the DCs that is locking his account. Whatever this is runs all day. His account is locked so often that he had to cerate a second account. As I was following the Troubleshooting Document for Account Lockout from Microsoft, I performed the next logical step and downloaded ALOCKOUT.DLL and installed it on one of the 2 DCs where the bad authentications were coming from. I was unable to see anything in the log file - So what would the next step be?? Anyone have any ideas on how to determine what this could be?? Thanks!!!
Guest Steve Goddard Posted February 8, 2008 Posted February 8, 2008 RE: account lockout question ... Never heard of the document, but what you should do is get yourself the windows 2003 resource kit tool account lockout. On the next lockout event find out which DC locked the account out on and trace the event log for the time/date. It will tell you where from, the actual workstation/node. That will indicate a long forgotton TS session, job or something that is locking out your account. -- Steve G. MCSA 2003 +M "Scott W" wrote: > Hello ... > > I have a domain with 7 DCs - I have an Admin who has not been able to use > his account since the last time he changed his password. > > I've poured over NETLOGON logs and SECURITY event logs and something is > running on 2 of the DCs that is locking his account. Whatever this is runs > all day. His account is locked so often that he had to cerate a second > account. > > As I was following the Troubleshooting Document for Account Lockout from > Microsoft, I performed the next logical step and downloaded ALOCKOUT.DLL and > installed it on one of the 2 DCs where the bad authentications were coming > from. > > I was unable to see anything in the log file - > > So what would the next step be?? Anyone have any ideas on how to determine > what this could be?? > > Thanks!!!
Recommended Posts