Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My team uses a virtual Windows Server 2008 to store our code repository. We all login using a shared user account. The IT department requires that we keep the automatic account locking for mistyped passwords turned on.

Every so often the account gets locked out because of this.

Is there a log or something that I can enable to track login attempts? I would love to get a host name, or even an IP address of these attempts so that we can track down who is having trouble with this system. We do have admin access to the virtual machine.

Pre-emptive I know that using shared user accounts isn't the recommended way to do this, but we are stuck with that system.

share|improve this question

migrated from Apr 7 '11 at 15:21

This question came from our site for computer enthusiasts and power users.

up vote 2 down vote accepted

Server 2008 comes with login/logout auditing already turned on (it wasn't in 2000 and 2003), so there are Security event-log entries already there showing these. The event-log IDs you're looking for are 4625 (failed login) and 4740 (Lockout). The data in these events should show the IP address or machine name of where the logins are coming from.

share|improve this answer
This is exactly what I needed! Thank you. – Frank Krueger Apr 7 '11 at 15:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.