I am working on a client system which had a domain migration which seemed to have gone a bit wrong, about a year ago. However, in the event logs on a a member server, there are constant entries about a user (Administrator) that tries to login but fails (the domain of this account is on the old domain). I have recommended a colleague to use sysinternals etc to find the process using this account, but is there any definitive way to find what process is using this account?
Thanks Gurdeep