Solved

Detect what connections a User Account has on network

Posted on 2013-11-15
3
323 Views
Last Modified: 2013-11-22
Hi,

We are having a recurring problem with our policies that we are wondering if there is a way, a tool or a piece of software that can help us out.

Win 2008 Server running our network. We have a password policy that requires pw changes every 30 days.

The problem we have is on a few accounts, as soon as they change their policy, they are getting locked out every 30 minutes or so because of failed login attempts. We know the failed login attempts is from remote connection that was set up with the old password. The problem is, we always have a hard time find where.

Is there a simple way to detect where the failed logins are coming from?

Thanks so much,
Ken
0
Comment
Question by:TheMastersTouch
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 250 total points
ID: 39652107
The only way to find out where accounts are getting locked out from is from the Security Logs on the Domain Controllers. If you have multiple domain controllers this can be a nightmare. This also makes it hard as each DC has hundreds of Security attempts a second and logs can easily get over written due to default setup.

The easiest way to find out this information is using a program called ADAudit Plus. This is not free software but it is definetly worth every penny. They have a 30 day fully featured trial you can use and see for youself.

ADAudit Plus - http://www.manageengine.com/products/active-directory-audit/

Will.
0
 
LVL 10

Accepted Solution

by:
Pramod Ubhe earned 250 total points
ID: 39655815
http://www.microsoft.com/en-us/download/details.aspx?id=18465

lockoutstatus.exe can give you last bad password time and the DC that it was generated. On that DC check for failure audit security logs for that user. There you can find client name/IP.
On that client you can check for disconnected RDP sessions or old passwords saved.
0
 

Author Closing Comment

by:TheMastersTouch
ID: 39670020
Thanks. Both helped!
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
I was prompted to write this article after the recent World-Wide Ransomware outbreak. For years now, System Administrators around the world have used the excuse of "Waiting a Bit" before applying Security Patch Updates. This type of reasoning to me …
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses
Course of the Month8 days, 17 hours left to enroll

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question