Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am facing a problem, every day around 17:00 4-5 domain user accounts get locked out. I think that the problem is from a script that is running ... somewhere... the problem is that I cannot pinpoint which computer/server tries to log in with incorrect credentials. Is there a way to find the computer name/IP of this machine?

share|improve this question
    
itll be in the access log files of the domain controller. –  Sirex Jun 7 '11 at 11:00
    
Which OS are the domain controllers running? 2003 or 2008? –  Lucky Luke Jun 7 '11 at 12:14

2 Answers 2

up vote 6 down vote accepted

I usually have luck doing it this way:

  1. Run LockoutStatus.exe.
  2. Enter the username and find out which of your DCs was the source of the lock ("Orig Lock" column) and when it happened ("Lockout Time" column).
  3. Examine the Security log on the DC at that time and you will usually be able to pinpoint it to a specific machine.
  4. Once you have the machine it's usually:
    • User has a scheduled task running in their name and their password has changed.
    • User has a disconnected RDP session.

If it happens at the same time daily I'd say its almost certainly a scheduled task.

share|improve this answer
    
+1 beat me to it. –  gravyface Jun 7 '11 at 11:04
    
    
The event ids you want to look for in the security event log are 4740 (Win2008) or 644 (Win2003 and earlier). –  Lucky Luke Jun 7 '11 at 12:14
    
I tryied the LockoutStatus.exe . It told me that 2 out of my three DC had locked the user... I tried to look the Security logs on both the DC and I got only Success Audits... I know it doesn't sound right... By the way my DC are 2003 R2 SP2... –  Gorbi_gr Jun 7 '11 at 13:57
1  
@Shane Madden You are absolutely right I apologize for my ignorance on the matter and with the help of you @Lucky Luke and @Graeme Donaldson I finally found the PC name and with nbtstat i found the IP... Thank you all for the help! –  Gorbi_gr Jun 7 '11 at 19:27

This was answered a while ago - My useraccount gets permanently locked by someone

share|improve this answer
    
Sounds like a different issue though ... –  Lucky Luke Jun 7 '11 at 12:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.