Solved

Event ID 644 not showing up on event Security Log.

Posted on 2007-03-26
4
977 Views
Last Modified: 2013-12-04
I have a Windows Server 2003 SP1 Domain Controller. We have one legacy NT4 BDC, no other Domain Controllers.

Whenever an account is locked, for instance by the user trying more than 5 passwords, the account lockout does not show up in the event Security Log.

To test this I tried it in my test environment, with just one 2003 DC and one XP SP2 client and the same thing happens I get no 644s. I do get 539s when I attempt to logon the client after the account is locked.

In the Default Domain Security setting Audit Policy I have everything set to audit, success and failure.

I don’t wish to make any changes to production until I can get this working in Test.

Does anybody have any suggestions or solutions?
0
Comment
Question by:BMCKRob
  • 2
  • 2
4 Comments
 
LVL 31

Expert Comment

by:Toni Uranjek
ID: 18798831
Do you get any 642s instead of 644?

Event ID:642
Description:
User Account Changed:
Account Locked.

0
 

Author Comment

by:BMCKRob
ID: 18802057
No, we are not getting any 642's either.
0
 
LVL 31

Accepted Solution

by:
Toni Uranjek earned 500 total points
ID: 18806200
How is your Audit policy set? Default Domain Controller Security Settings should have the following Audit policy set "Audit account managment" to Success, for event ID 644 to appear.
Did you check BDC logs also?
0
 

Author Comment

by:BMCKRob
ID: 18816132
That is IT!!!!  We have been working on this for weeks, none of the documentation I have read says that needs to be set. Thanks you have earned the points.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is a guide to the following problem (not exclusive but here) on Windows: Users need our support and we supporters often use global administrative accounts to do this. Using these accounts safely is a real challenge. Any admin who takes se…
Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Concerto provides fully managed cloud services and the expertise to provide an easy and reliable route to the cloud. Our best-in-class solutions help you address the toughest IT challenges, find new efficiencies and deliver the best application expe…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now