Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

This morning a user was unable to login on his windows account. After unlocking it in the active directory every thing was working again.

Is there a way to see in event viewer or some other place why this account was locked? I read this answer but I don't know how to do that.

share|improve this question

marked as duplicate by Greg Askew, Ward, TheCleaner, Scott Pack, gWaldo May 16 '13 at 15:45

This question was marked as an exact duplicate of an existing question.

Nope. The mentioned question is for a 2k3 server only. – BetaRide May 16 '13 at 12:00
The answer(s) given applies to all current versions of AD, may require some tweaking depending on the version and tools used but they will work. – David V May 16 '13 at 13:38

When you open Group Policy Management you will see a folder under the domain you wish to use labeled Domain Controllers. The policy you need to modify should be the only one under that (by default) called Default Domain Controllers Policy. The specific auditing policy you'll want to enable/modify is Audit account logon events. The audits will show up in the event log under security.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.