Re: Account Lockout Question/Problem
- From: "Jorge de Almeida Pinto [MVP - DS]" <SubstituteThisWithMyFullNameSeparatedByDots@xxxxxxxxx>
- Date: Thu, 23 Oct 2008 17:43:49 +0200
google for NETLOGON debugging
that should help in determining where it comes from
--
Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)
# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #
BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
"Tom" <Tom@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:C5F02CE9-8E31-4DCA-A62B-1016E1B312C6@xxxxxxxxxxxxxxxx
We have two accounts that randomly get locked out, we have auditing enabled
on our DC so I can see Authentication attempts being made using both
accounts. Our account lockout policy is set to lockout accounts after 7
invalid logon attempts. The problem with diagnosing this is that when I check
the security logs in the DC the “source workstations:” come from various
sources such as \\localhost, \\84.120.100.240 \\FILECAF etc basically it
looks like the logon attempts are spoofing their source address. A couple of
users got spyware two months ago but we removed those systems from the
network. The usual suspects for account lockout problems such as mapped
network drives with invalid passwords and services with incorrect cached
credentials don’t apply here. How can I figure out where exactly these logon
attempts are coming from? Our DS’s are win2003 R2 SP2
.
- References:
- Account Lockout Question/Problem
- From: Tom
- Account Lockout Question/Problem
- Prev by Date: Re: Are these 529s hacking attempts or some other problem?
- Next by Date: RDP & IP security help
- Previous by thread: RE: Account Lockout Question/Problem
- Next by thread: Where's this logon attempt coming from?
- Index(es):
Relevant Pages
|
