Re: Event log for disabled account

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 07/30/04 

Date: Fri, 30 Jul 2004 07:38:23 -0700

Yes, account lockout can be audited if you have the
audit policy set to log the logon events. You will find
the records at the machine where the authentication was
processed. For example, you may need to check the
logs of all domain controllers using a tool such as
EventCombMT released by MS 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Troy Tate" <ttate_nospam@ctscorp.com> wrote in message
news:ohhig0l624cvuuqutkcc1o3s3etacd7ct2@4ax.com...
> When an account is disabled or locked out due to too many attempts
> with an incorrect password, is this logged to any event log (WinNT4)?
> I have tested locking an account and do not see any events being
> logged. I would like to use some paging software to notify me in
> advance that a user account is locked out prior to being called by the
> user.
>
> Thanks for your assistance.

Relevant Pages

  • Re: Windows Passwords
    ... "Windows Vista for Dummies" manual. ... I started by creating a test user account. ... The reason I say this is that, when I turned the Guest ...
    (microsoft.public.windows.vista.general)
  • Re: Help Me Understand User Accounts
    ... When you log off and log back in as the limited user you'll be able to ... you'll need to set up a new email account (under the new ... limited user account) the same as you had before, ... Administrator accounts are the default type of account ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Windows Service Account
    ... you can use the find IIDentity to the user to give folder permissions ... The OP does not need to find which user account is running the Windows ... Local System account has mighty ...
    (microsoft.public.dotnet.general)
  • Re: Logoff / Slow Bootups / Outlook attachements / Outlook Not res
    ... When you logon the problematic user account on the good user's computer, ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • Re: DC Temporarily Off-line, Remaining DC Struggling
    ... suspects this issue is related to the account and roaming profile. ... Please make sure all user accounts are replicated to win2k3 DC. ... Does this issue only occurs if the user account uses ...
    (microsoft.public.windows.server.active_directory)
Quantcast