Solved

Detect what connections a User Account has on network

Posted on 2013-11-15
3
310 Views
Last Modified: 2013-11-22
Hi,

We are having a recurring problem with our policies that we are wondering if there is a way, a tool or a piece of software that can help us out.

Win 2008 Server running our network. We have a password policy that requires pw changes every 30 days.

The problem we have is on a few accounts, as soon as they change their policy, they are getting locked out every 30 minutes or so because of failed login attempts. We know the failed login attempts is from remote connection that was set up with the old password. The problem is, we always have a hard time find where.

Is there a simple way to detect where the failed logins are coming from?

Thanks so much,
Ken
0
Comment
Question by:TheMastersTouch
3 Comments
 
LVL 53

Assisted Solution

by:Will Szymkowski
Will Szymkowski earned 250 total points
ID: 39652107
The only way to find out where accounts are getting locked out from is from the Security Logs on the Domain Controllers. If you have multiple domain controllers this can be a nightmare. This also makes it hard as each DC has hundreds of Security attempts a second and logs can easily get over written due to default setup.

The easiest way to find out this information is using a program called ADAudit Plus. This is not free software but it is definetly worth every penny. They have a 30 day fully featured trial you can use and see for youself.

ADAudit Plus - http://www.manageengine.com/products/active-directory-audit/

Will.
0
 
LVL 10

Accepted Solution

by:
Pramod Ubhe earned 250 total points
ID: 39655815
http://www.microsoft.com/en-us/download/details.aspx?id=18465

lockoutstatus.exe can give you last bad password time and the DC that it was generated. On that DC check for failure audit security logs for that user. There you can find client name/IP.
On that client you can check for disconnected RDP sessions or old passwords saved.
0
 

Author Closing Comment

by:TheMastersTouch
ID: 39670020
Thanks. Both helped!
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
An article on effective troubleshooting
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

778 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question