Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Finding who disabled account

Posted on 2010-11-23
Medium Priority
Last Modified: 2012-05-10

A user account was disabled today, I want to find out, when, why this was done and who did it. She was logged in today in the morning. Could it be done automatically by Windows?

We're in a SBS2003 environment.

Question by:m2chaudh
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 2
  • +4

Expert Comment

ID: 34200445
yes this is possible due to account lockout which will disable the account if the failed logon attempts threshold limit has been reached.
there is no way directly to find out who disabled it if that was the case.
But you can look at the security logs and see who logged in around that time or was already logged on then.
LVL 57

Expert Comment

by:Mike Kline
ID: 34200457
You have to have enabled auditing, check the auditing policy for the DCs

Computer Configuration | Windows Settings | Security Settings | Local Policies | Audit Policy

For account access like passwords and accounts being disabled look to see if "Audit Account Management" is set to Success.

If it is or if it is not once you set it then you will look through your security logs for event 629  http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=629

You will be looking at the security event log on that DC.



Expert Comment

ID: 34200459
run eventvwr.msc and look at the security logs
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why


Expert Comment

ID: 34200471

use the link above with the security log and you will find out who had physical access to the server at tht time.
LVL 10

Expert Comment

ID: 34200475
Here is a sample of event for disabling account.

Caller is the person who disabled it.
event id 629


User Account Changed:
  Account Disabled.
  Target Account Name: Bill
  Target Domain: MS0
  Target Account ID: S-1-5-21-1234561642-8123456618-725345543-1008
  Caller User Name: Administrator
  Caller Domain: ACME
  Caller Logon ID: (0x0,0xD44E)
  Privileges: -

Expert Comment

by:Rommel Sultan
ID: 34200476
Check the Event viewer.
It should register in Security Log

Sample log
User Account Disabled:
       Target Account Name:      Guest
       Target Domain:      C686724
       Target Account ID:      C686724\Guest
       Caller User Name:      rsultan
       Caller Domain:      COC
       Caller Logon ID:      (0x0,0x1DC49)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Author Comment

ID: 34200537
I want to find out why it was disabled, and who disabled the account in AD. The security audits only show me, this :

Logon Failure:
       Reason:            Account currently disabled
       User Name:      llex
       Domain:            PACSRV
       Logon Type:      3
       Logon Process:      NtLmSsp
       Authentication Package:      NTLM
       Workstation Name:      KAKABEKA07
       Caller User Name:      -
       Caller Domain:      -
       Caller Logon ID:      -
       Caller Process ID:      -
       Transited Services:      -
       Source Network Address:
       Source Port:      1937

If you see the reason field for login failure, it says Account disabled, she didnt have failure logins before this happened. She was logged in this morning. So account was disabled by someone or the Server did it, I want to know what time server or someone disabled her account.

Author Comment

ID: 34200546
Btw I have enabled her account now, I just want to know, why this happened in the first place. Thanks!

Assisted Solution

men7s earned 664 total points
ID: 34200574
the answer will be in the security logs where you were, between this and when she last was logged on, like i said look at the logon types and you will be able to work it out.
Because you are on SBS if you go to server management window then select monitoring i think and scroll to the bottom it should also show you failed logon attempts so then that will rule out account lockout
LVL 33

Accepted Solution

Todd Gerbert earned 668 total points
ID: 34200627
By default I believe only Logons and Logoffs are logged in the Security Log (at least that's the case on my Server 2003 system, I can't speak to SBS).  If Account Management logging was turned off at the time your user's account disabled, then that action would not have been logged.

What might help is look and see who else (especially those users with access to modify an account) logged onto the server at about the same time your users account became disabled.

Author Comment

ID: 34200731
That was a good idea tgerbert, but it will be hard to say. I've to see, which workstation user was logged on to, and time nd sorting through all the audit entries between this morning and now, is just tedious.

men7s, there has been no failure due to wrong pwd or as such, the account was disabled, thats why it failed logins if at all (thats the reason I see for all failed logins by that person, account disabled). Last time she logged in succesfully was in the morning.

Is there a easier way to find out, or I have to dig through success/fail audits, see who logged on to server during specific time perioid (all day today) etc..

Expert Comment

ID: 34200753
unless you set other auditing options or third party software to monitor, then you are left with these logs to trail through im afraid.
LVL 57

Expert Comment

by:Mike Kline
ID: 34200766
You can search through the event logs for specific events, if auditing was on just search/filter for the 629 events


LVL 33

Expert Comment

by:Todd Gerbert
ID: 34200791
UNLESS your audit policy was [i]already[/i] set to log such events, I'm afraid your only recourse will be to wade through the logs and hope to see some events that correspond. You probably would have better luck just asking your admins. ;)
LVL 77

Assisted Solution

by:Rob Williams
Rob Williams earned 668 total points
ID: 34201563
A "Logon Type: 3" tells you this was locked out due to attempted internal access, as opposed to through external access using Remote Web Workplace or Remote desktop.
"Source Network Address:
" tells you from what IP. If this is the IP of the workstation it means either someone at the console tried to logon multiple times unsuccessfully, or a service such as a mapped drive tried to connect.
This is often caused by someone mapping a drive using different credentials and the password expiring.

Author Closing Comment

ID: 34207024
Thanks for all your help. I think this would require a lot of cross-examination. I was hoping ti wasnt a security breach and as Rob mentioned, it was internal, and we have limited admin access to fewer users in company now.

Thanks for prompt replies!

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
How to deal with a specific error when using the Enable-RemoteMailbox cmdlet to create a mailbox in the cloud-based service, for an existing user in an on-premises Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question