Solved

Need to find out at what time and what machine a user account was locked out at

Posted on 2014-02-08
3
384 Views
Last Modified: 2014-03-29
Someone locked out a user account in Active Directory and I need to find out what time and from what machine it was locked out. I have already unlocked the account. I have a Server 2003 Domain Controller. Thanks in advance for the help.
0
Comment
Question by:schmida54017
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 23

Accepted Solution

by:
Patrick Bogers earned 500 total points
ID: 39844220
Put a filter on eventlog and look for Event 644 and 539
0
 
LVL 5

Expert Comment

by:Pankaj_401
ID: 39846580
"Account lockout tool" is the best option to find out "what time and from what machine" it was locked out. By this tool, You can get the complete information about the account lockout cause and status.
Further, if you wish to avoid such issues and get alert of all changes in AD, you can also check this software(http://www.activedirectoryaudit.com/) which would be a best practice and good choice for you.
0
 
LVL 26

Expert Comment

by:Leon Fester
ID: 39846675
There is a tool from Microsoft to speed up this process:
EventCombMT is a multithreaded tool that you can use to search the event logs of several different computers for specific events, all from one central location. You can configure EventCombMT to search the event logs in a very detailed fashion. The following are some of the search parameters that you can specify:•Individual event IDs
•Multiple event IDs
•A range of event IDs
•An event source
•Specific event text
•How many minutes, hours, or days back to scan
Some specific search categories are built-in, such as Account Lockouts. The Account Lockouts search is preconfigured to include event IDs 529, 644, 675, 676, and 681. Additionally, you can add event ID 12294 to search for potential attacks against the Administrator account.
http://support.microsoft.com/kb/824209
0

Featured Post

[Webinar] Learn How Hackers Steal Your Credentials

Do You Know How Hackers Steal Your Credentials? Join us and Skyport Systems to learn how hackers steal your credentials and why Active Directory must be secure to stop them. Thursday, July 13, 2017 10:00 A.M. PDT

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question