Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an account that keeps getting locked out (a domain account).

I can see when the last bad login occurred and the bad login count = 5. What I want to determine is the IP address of the machine that is responsible for the bad logins.

How can I find this out?

share|improve this question
up vote 4 down vote accepted

First, auditing of logon failures needs to be enabled. As a matter of practice, I've always put it in an enforced default domain policy, but you should at least have it applied to your domain controllers. The entry is called Audit Account Logon Events, and it only defaults to logging Success for some reason. Info on this setting is available from Microsoft on Technet here.

Once that is enabled, the security logs of the Domain Controller processing the login should contain the necessary information. Specifically, check for Failure Audits of Logon/Logoff Events. The username should be a column called User that you can sort/filter by to ease the search.

share|improve this answer
Logon event auditing needs to be enabled first, which isn't by default. – joeqwerty Mar 23 '11 at 12:45
You're correct, come to think of it. I'll edit the answer to reflect that. – Hyppy Mar 23 '11 at 12:49
+1, Example of the logged event: – Chris S Mar 23 '11 at 13:16
I have a Server 2008R2 box as well and looking in my local policy the success and failure are both checked. Yet when I logoff my DC and then try to logon with a bad password, or an account that does not exist, then logon with my admin account... I check the security log and NO 675 events are there. – Arvo Bowen Jan 12 '15 at 17:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.