Locked out Account, how to know which computer has locked out this user?!

Posted on 2008-01-28
Medium Priority
Last Modified: 2010-03-17
Hi everybody,
I used a shared account for the development, and this user account is locked out many times per day. I wanted to khow how to find which computer has locked out this user?!
Thanks in advance for your help.
Best Regards
Question by:sungardit
LVL 31

Accepted Solution

Toni Uranjek earned 500 total points
ID: 20758592

Check your domain controllers security logs. Event 644 wil be recorded when user is locked out. Check this event for workstation name or IP. If it is not recorded search for events 675. This event is recorded when user enters bad password. This event conteins the following information amongst others: "Client Address".



Author Comment

ID: 20758716
Hi Tony,
Thank you for your quick answer. I found exactly what I wanted in event 644.

Featured Post

Never miss a deadline with monday.com

The revolutionary project management tool is here!   Plan visually with a single glance and make sure your projects get done.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Let's recap what we learned from yesterday's Skyport Systems webinar.
The article explains the process to deploy a Self-Service password reset portal I developed a few years ago. Hopefully, it will prove useful to someone.  Any comments, bug reports etc. are welcome...
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

594 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question