?
Solved

Active Directory 2008 Enable Account Lockout Auditing

Posted on 2010-08-12
2
Medium Priority
?
1,908 Views
Last Modified: 2013-11-25
Hi,

How can I enable the account lockout events in the eventviewer in AD 2008.  Also, what event id's are related to user account lockout?
0
Comment
Question by:Jack_son_
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 57

Accepted Solution

by:
Mike Kline earned 1000 total points
ID: 33421452
Have a meeting so I can't write more now but look at this  http://www.windowsitpro.com/article/auditing/access-denied-auditing-user-account-lockouts.aspx

I think the event is 644    I'll try and test later to make sure

Thanks

Mike
0
 
LVL 2

Assisted Solution

by:modru
modru earned 1000 total points
ID: 33422885
mkline is correct, event ID 644;
http://www.eventid.net/display.asp?eventid=644&eventno=227&source=Security&phase=1

How to enable logging of these events;
To effectively troubleshoot account lockout, enable auditing at the domain level for the following events:
Account Logon Events – Failure
Account Management – Success
Logon Events – Failure

http://technet.microsoft.com/en-us/library/cc776964(WS.10).aspx

To modify the GPO for the settings;
http://technet.microsoft.com/en-us/library/cc775412(WS.10).aspx
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Introduction to Processes
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question