1

I am having trouble getting Windows Server 2008 to log when domain user accounts are being locked. My Domain Controllers are all Windows Server 2008 R1.

I am able to find Audit Failure events (ID 4771) for incorrect username/password, but not when the account is locked out after too many incorrect attempts. So far I've discovered from reading online that the "Audit Account Lockout" group policy (Found at Computer Config > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff) must be set to Failure so that it logs the failures, but it still isn't being logged.

I have configured this policy under the Default Domain Policy and Default Domain Controllers Policy since there are a lot of account/password policies enabled here by default, normally I don't touch these GPOs.

After testing, I can see event ID 4625 is logged on the client's local event logs, but not on the DC. Again, I can see the incorrect username/password event 4771 on the DCs (I've checked all the DC logs too), just not 4625.

Note: When I configured the Audit Account Lockout event in Group Policy I configured it through the RSAT tools on my workstation. When I try to configure it locally on the DC, that specific setting is not available. My workstation is Windows 8.1 and Server is 2008 R1. I'm not sure if that makes a difference, but I've used my workstation to configure group policies before that I can't configure on the DC and they have worked.

Thanks.

2

1 Answer 1

1

Craig, you are correct it is 4740, however I did search for that before and received nothing. On the Windows 7 client it is 4625.

I found the issue. The Audit Account Lockout policy I mentioned was set to "failure" only. Once I enabled "success" it logged the lockouts with ID 4740. I thought I had tested "success" previously, but after filtering the log for 4740 I only found today's events. The log in Windows 7 must have thrown me off since that one shows 4625 with "failure" and account lockout as the category.

Thanks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .