I am facing a problem, every day around 17:00 4-5 domain user accounts get locked out. I think that the problem is from a script that is running ... somewhere... the problem is that I cannot pinpoint which computer/server tries to log in with incorrect credentials. Is there a way to find the computer name/IP of this machine?
-
itll be in the access log files of the domain controller.– SirexJun 7, 2011 at 11:00
-
Which OS are the domain controllers running? 2003 or 2008?– Lucky LukeJun 7, 2011 at 12:14
Add a comment
|
2 Answers
I usually have luck doing it this way:
- Run LockoutStatus.exe.
- Enter the username and find out which of your DCs was the source of the lock ("Orig Lock" column) and when it happened ("Lockout Time" column).
- Examine the Security log on the DC at that time and you will usually be able to pinpoint it to a specific machine.
- Once you have the machine it's usually:
- User has a scheduled task running in their name and their password has changed.
- User has a disconnected RDP session.
If it happens at the same time daily I'd say its almost certainly a scheduled task.
answered Jun 7, 2011 at 11:03
-
-
The event ids you want to look for in the security event log are 4740 (Win2008) or 644 (Win2003 and earlier). Jun 7, 2011 at 12:14
-
I tryied the LockoutStatus.exe . It told me that 2 out of my three DC had locked the user... I tried to look the Security logs on both the DC and I got only Success Audits... I know it doesn't sound right... By the way my DC are 2003 R2 SP2... Jun 7, 2011 at 13:57
-
@Gorbi_gr A lockout event is a success audit, if the account was successfully locked. Look for the event ID that @Lucky Luke mentioned, 644. Jun 7, 2011 at 15:00
-
1@Shane Madden You are absolutely right I apologize for my ignorance on the matter and with the help of you @Lucky Luke and @Graeme Donaldson I finally found the PC name and with nbtstat i found the IP... Thank you all for the help! Jun 7, 2011 at 19:27
