Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

This morning a user was unable to login on his windows account. After unlocking it in the active directory every thing was working again.

Is there a way to see in event viewer or some other place why this account was locked? I read this answer http://serverfault.com/a/391753/76180 but I don't know how to do that.

share|improve this question

marked as duplicate by Greg Askew, Ward, TheCleaner, Scott Pack, gWaldo May 16 '13 at 15:45

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
Nope. The mentioned question is for a 2k3 server only. –  BetaRide May 16 '13 at 12:00
    
The answer(s) given applies to all current versions of AD, may require some tweaking depending on the version and tools used but they will work. –  David V May 16 '13 at 13:38

1 Answer 1

When you open Group Policy Management you will see a folder under the domain you wish to use labeled Domain Controllers. The policy you need to modify should be the only one under that (by default) called Default Domain Controllers Policy. The specific auditing policy you'll want to enable/modify is Audit account logon events. The audits will show up in the event log under security.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.