<div>
Thanks Thomas. &nbsp;Yes - I believe we can do that. &nbsp;I'll check with colleagues. &nbsp;thanks for your help. &nbsp;Best regards...Paul
</div>


Thanks Thomas.  Yes - I believe we can do that.  I'll check with colleagues.  thanks for your help.  Best regards...Paul

<div>
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.<br />
<br />
I have recommended this question be closed as follows:<br />
<br />
Accept: Thomas Zucker-Scharff (<a href="https:#a42337948" rel="ugc">https:#a42337948</a>)<br />
<br />
If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.<br />
<br />
seth2740<br />
Experts-Exchange Cleanup Volunteer
</div>


No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Accept: Thomas Zucker-Scharff (https:#a42337948 [https:#a42337948])

If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

seth2740
Experts-Exchange Cleanup Volunteer

<div>
<div class="content wysiwyg-content">
We are investigating a problem where a user's AD account goes into Account Locked status.<br />
<br />
We need to extract Account Lockout events from the Security Log of a Windows 2003 server. &nbsp;We are not permitted to run additional software on the server. &nbsp;We have looked at Eventcomb, which does do the job, but testing has shown that it can't complete a filter of the log before the log wraps and this causes the tool to fail.<br />
<br />
We know the event IDs we need. &nbsp;How can we extract or export these events?<br />
<br />
Thanks and regards...Paul
</div>
</div>


We are investigating a problem where a user's AD account goes into Account Locked status.

We need to extract Account Lockout events from the Security Log of a Windows 2003 server.  We are not permitted to run additional software on the server.  We have looked at Eventcomb, which does do the job, but testing has shown that it can't complete a filter of the log before the log wraps and this causes the tool to fail.

We know the event IDs we need.  How can we extract or export these events?

Thanks and regards...Paul

Windows 2003: Extract Account Lockout events in the Security Log

This topic area includes legacy versions of Windows prior to Windows 2000: Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions including Windows Mobile.

Windows OS

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).