Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My team uses a virtual Windows Server 2008 to store our code repository. We all login using a shared user account. The IT department requires that we keep the automatic account locking for mistyped passwords turned on.

Every so often the account gets locked out because of this.

Is there a log or something that I can enable to track login attempts? I would love to get a host name, or even an IP address of these attempts so that we can track down who is having trouble with this system. We do have admin access to the virtual machine.

Pre-emptive I know that using shared user accounts isn't the recommended way to do this, but we are stuck with that system.

share|improve this question
add comment

migrated from superuser.com Apr 7 '11 at 15:21

This question came from our site for computer enthusiasts and power users.

1 Answer

up vote 2 down vote accepted

Server 2008 comes with login/logout auditing already turned on (it wasn't in 2000 and 2003), so there are Security event-log entries already there showing these. The event-log IDs you're looking for are 4625 (failed login) and 4740 (Lockout). The data in these events should show the IP address or machine name of where the logins are coming from.

share|improve this answer
    
This is exactly what I needed! Thank you. –  Frank Krueger Apr 7 '11 at 15:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.