Re: Determine when a Windows XP user account has been disabled

I would start by looking in the security log via Event Viewer as many events
are located there with informational detail that will help. If you have not
done so yet enable logging of account management events so that more details
will be shown. Most likely auditing of account logon or logon events are
already enabled. You can mange that in Local Security Policy - secpol.msc.
Free tools such as Event Comb from Microsoft can make it easier to parse the
logs. The command net user username will also show helpful detail about a
local user account. such as last logon time.

Steve

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/516.mspx?mfr=true

"Frank I." <FrankI@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F4228FC7-B02E-4594-B7CC-D4AB997B26FA@xxxxxxxxxxxxxxxx
Hi all,

I have the following question regarding Windows XP:

Is it possible to determine the date (and evtl. time) when a user account
has been disabled/locked?

The account is a local user account and the machine is not part of a
domain.
It is Windows XP Pro with SP2 and the latest hotfixes applied and the
auditing of "account modification" is disabled (as it is by default in
Windows). Only logon/logoff is being audited.

Is there any way to get this information?

Thanks for every help or suggestion.
Frank


.

Relevant Pages