Solved

Detect what connections a User Account has on network

Posted on 2013-11-15
3
318 Views
Last Modified: 2013-11-22
Hi,

We are having a recurring problem with our policies that we are wondering if there is a way, a tool or a piece of software that can help us out.

Win 2008 Server running our network. We have a password policy that requires pw changes every 30 days.

The problem we have is on a few accounts, as soon as they change their policy, they are getting locked out every 30 minutes or so because of failed login attempts. We know the failed login attempts is from remote connection that was set up with the old password. The problem is, we always have a hard time find where.

Is there a simple way to detect where the failed logins are coming from?

Thanks so much,
Ken
0
Comment
Question by:TheMastersTouch
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 250 total points
ID: 39652107
The only way to find out where accounts are getting locked out from is from the Security Logs on the Domain Controllers. If you have multiple domain controllers this can be a nightmare. This also makes it hard as each DC has hundreds of Security attempts a second and logs can easily get over written due to default setup.

The easiest way to find out this information is using a program called ADAudit Plus. This is not free software but it is definetly worth every penny. They have a 30 day fully featured trial you can use and see for youself.

ADAudit Plus - http://www.manageengine.com/products/active-directory-audit/

Will.
0
 
LVL 10

Accepted Solution

by:
Pramod Ubhe earned 250 total points
ID: 39655815
http://www.microsoft.com/en-us/download/details.aspx?id=18465

lockoutstatus.exe can give you last bad password time and the DC that it was generated. On that DC check for failure audit security logs for that user. There you can find client name/IP.
On that client you can check for disconnected RDP sessions or old passwords saved.
0
 

Author Closing Comment

by:TheMastersTouch
ID: 39670020
Thanks. Both helped!
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
QoS on Cisco router 10 59
Exchange password change on mobile 2 106
Passing credentials through NET USE without hard coding the password? 8 71
msiexec won't run 4 29
I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
This article explains how to install and use the NTBackup utility that comes with Windows Server.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question