Solved

Detect what connections a User Account has on network

Posted on 2013-11-15
3
311 Views
Last Modified: 2013-11-22
Hi,

We are having a recurring problem with our policies that we are wondering if there is a way, a tool or a piece of software that can help us out.

Win 2008 Server running our network. We have a password policy that requires pw changes every 30 days.

The problem we have is on a few accounts, as soon as they change their policy, they are getting locked out every 30 minutes or so because of failed login attempts. We know the failed login attempts is from remote connection that was set up with the old password. The problem is, we always have a hard time find where.

Is there a simple way to detect where the failed logins are coming from?

Thanks so much,
Ken
0
Comment
Question by:TheMastersTouch
3 Comments
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 250 total points
ID: 39652107
The only way to find out where accounts are getting locked out from is from the Security Logs on the Domain Controllers. If you have multiple domain controllers this can be a nightmare. This also makes it hard as each DC has hundreds of Security attempts a second and logs can easily get over written due to default setup.

The easiest way to find out this information is using a program called ADAudit Plus. This is not free software but it is definetly worth every penny. They have a 30 day fully featured trial you can use and see for youself.

ADAudit Plus - http://www.manageengine.com/products/active-directory-audit/

Will.
0
 
LVL 10

Accepted Solution

by:
Pramod Ubhe earned 250 total points
ID: 39655815
http://www.microsoft.com/en-us/download/details.aspx?id=18465

lockoutstatus.exe can give you last bad password time and the DC that it was generated. On that DC check for failure audit security logs for that user. There you can find client name/IP.
On that client you can check for disconnected RDP sessions or old passwords saved.
0
 

Author Closing Comment

by:TheMastersTouch
ID: 39670020
Thanks. Both helped!
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Load balancing is the method of dividing the total amount of work performed by one computer between two or more computers. Its aim is to get more work done in the same amount of time, ensuring that all the users get served faster.
An article on effective troubleshooting
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question