Locked Accounts...

From: Erik Presnell (presnell_at_milltec.com)
Date: 07/30/03 

Date: Wed, 30 Jul 2003 08:06:57 -0500

This seems to be a popular theme on this board. Here are my issues. I have
a symantec coporate firewall, I have only a few of the inbound ports open.
Every day random users are locked out. I have auditing enabled so I know
the two win2k servers that are trying to access them, but I have had no
success in stopping it. So my question is, once you have found the servers
that give you the 539 event ID's, then what? Also I did download the
Altools.exe and used that to track the event id's, but I can't load that dll
file because Microsoft warns against it. Any help would be appreciated, I
haven't got much sleep in a while. Thanks.