Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm in a medium size enterprise environment using Active Directory for authentication etc. Considering if we should activate an account lockout policy for failed login attempts I need to gather statistics on the current number of such events.

I've read MS Account Lockout Best Practices but still, I'm nowhere near understanding how to do this. The document focuses on discovering the reasons for account lockout rather than getting a clear picture from the event logs.

So, my question is this: where should I look, what should I look for (specific event IDs, Failure Codes, anything else?) to find out the number of failed logins (the user tries over and over with the wrong password). Extra bonus if I can script the process.

Some additional info: The AD servers are Windows 2003 (with one extra running Windows 2008)

Please forgive my AD ignorance.

Many thanks in advance.

share|improve this question
    
How many times do you think people are screwing up their passwords in the morning? You can activate the logging on the AD servers and gather the numbers from there, but practically in our environment we just set up a reasonable number and gauge from support calls. If people can't get their password in three to five times in a row, there is a problem with their use of the system, and setting it too high defeats the purpose (except from automated brute force.) –  Bart Silverstrim May 8 '12 at 11:02

1 Answer 1

Look (as in, apply a filter) in the Security event log on your domain controllers for EventCode 675, EventType 16. This equates to "Pre-authentication failed", which seems to be the precursor to EventCode 644, EventType 8 - "User Account Locked Out".

share|improve this answer
    
Thanks! I'll look into it... –  Geotag May 8 '12 at 12:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.