Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an account that keeps getting locked out (a domain account).

I can see when the last bad login occurred and the bad login count = 5. What I want to determine is the IP address of the machine that is responsible for the bad logins.

How can I find this out?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

First, auditing of logon failures needs to be enabled. As a matter of practice, I've always put it in an enforced default domain policy, but you should at least have it applied to your domain controllers. The entry is called Audit Account Logon Events, and it only defaults to logging Success for some reason. Info on this setting is available from Microsoft on Technet here.

Once that is enabled, the security logs of the Domain Controller processing the login should contain the necessary information. Specifically, check for Failure Audits of Logon/Logoff Events. The username should be a column called User that you can sort/filter by to ease the search.

share|improve this answer
Logon event auditing needs to be enabled first, which isn't by default. –  joeqwerty Mar 23 '11 at 12:45
You're correct, come to think of it. I'll edit the answer to reflect that. –  Hyppy Mar 23 '11 at 12:49
+1, Example of the logged event: netid.washington.edu/images/675.jpg –  Chris S Mar 23 '11 at 13:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.