0

I am working on a client system which had a domain migration which seemed to have gone a bit wrong, about a year ago. However, in the event logs on a a member server, there are constant entries about a user (Administrator) that tries to login but fails (the domain of this account is on the old domain). I have recommended a colleague to use sysinternals etc to find the process using this account, but is there any definitive way to find what process is using this account?

Thanks Gurdeep

1
  • In the failed event, you should have IP of client (if it's through the network) Apr 4, 2012 at 22:36

1 Answer 1

0

I can only think of several places to look on a server
- Scheduled task - Service config - An icon using RunAs (although I don't think you can save the credentials)

I wouldn't think it would be too hard to review these manually.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .