Solved

Detect what connections a User Account has on network

Posted on 2013-11-15
3
303 Views
Last Modified: 2013-11-22
Hi,

We are having a recurring problem with our policies that we are wondering if there is a way, a tool or a piece of software that can help us out.

Win 2008 Server running our network. We have a password policy that requires pw changes every 30 days.

The problem we have is on a few accounts, as soon as they change their policy, they are getting locked out every 30 minutes or so because of failed login attempts. We know the failed login attempts is from remote connection that was set up with the old password. The problem is, we always have a hard time find where.

Is there a simple way to detect where the failed logins are coming from?

Thanks so much,
Ken
0
Comment
Question by:TheMastersTouch
3 Comments
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 250 total points
Comment Utility
The only way to find out where accounts are getting locked out from is from the Security Logs on the Domain Controllers. If you have multiple domain controllers this can be a nightmare. This also makes it hard as each DC has hundreds of Security attempts a second and logs can easily get over written due to default setup.

The easiest way to find out this information is using a program called ADAudit Plus. This is not free software but it is definetly worth every penny. They have a 30 day fully featured trial you can use and see for youself.

ADAudit Plus - http://www.manageengine.com/products/active-directory-audit/

Will.
0
 
LVL 10

Accepted Solution

by:
Pramod Ubhe earned 250 total points
Comment Utility
http://www.microsoft.com/en-us/download/details.aspx?id=18465

lockoutstatus.exe can give you last bad password time and the DC that it was generated. On that DC check for failure audit security logs for that user. There you can find client name/IP.
On that client you can check for disconnected RDP sessions or old passwords saved.
0
 

Author Closing Comment

by:TheMastersTouch
Comment Utility
Thanks. Both helped!
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Join & Write a Comment

This is the first one of a series of articles I’ll be writing to address technical issues that are always referred to as network problems. The network boundaries have changed, therefore having an understanding of how each piece in the network  puzzl…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now