We help IT Professionals succeed at work.

Locked out Account, how to know which computer has locked out this user?!

Medium Priority
255 Views
Last Modified: 2010-03-17
Hi everybody,
I used a shared account for the development, and this user account is locked out many times per day. I wanted to khow how to find which computer has locked out this user?!
Thanks in advance for your help.
Best Regards
Comment
Watch Question

Consultant/Trainer
Commented:
Hi!

Check your domain controllers security logs. Event 644 wil be recorded when user is locked out. Check this event for workstation name or IP. If it is not recorded search for events 675. This event is recorded when user enters bad password. This event conteins the following information amongst others: "Client Address".

HTH

Toni

Author

Commented:
Hi Tony,
Thank you for your quick answer. I found exactly what I wanted in event 644.
Regards

Explore More ContentExplore courses, solutions, and other research materials related to this topic.