I am facing a problem, every day around 17:00 4-5 domain user accounts get locked out. I think that the problem is from a script that is running ... somewhere... the problem is that I cannot pinpoint which computer/server tries to log in with incorrect credentials. Is there a way to find the computer name/IP of this machine?

  • itll be in the access log files of the domain controller. – Sirex Jun 7 '11 at 11:00
  • Which OS are the domain controllers running? 2003 or 2008? – Lucky Luke Jun 7 '11 at 12:14

I usually have luck doing it this way:

  1. Run LockoutStatus.exe.
  2. Enter the username and find out which of your DCs was the source of the lock ("Orig Lock" column) and when it happened ("Lockout Time" column).
  3. Examine the Security log on the DC at that time and you will usually be able to pinpoint it to a specific machine.
  4. Once you have the machine it's usually:
    • User has a scheduled task running in their name and their password has changed.
    • User has a disconnected RDP session.

If it happens at the same time daily I'd say its almost certainly a scheduled task.

  • The event ids you want to look for in the security event log are 4740 (Win2008) or 644 (Win2003 and earlier). – Lucky Luke Jun 7 '11 at 12:14
  • I tryied the LockoutStatus.exe . It told me that 2 out of my three DC had locked the user... I tried to look the Security logs on both the DC and I got only Success Audits... I know it doesn't sound right... By the way my DC are 2003 R2 SP2... – QuantumBITS Jun 7 '11 at 13:57
  • @Gorbi_gr A lockout event is a success audit, if the account was successfully locked. Look for the event ID that @Lucky Luke mentioned, 644. – Shane Madden Jun 7 '11 at 15:00
  • 1
    @Shane Madden You are absolutely right I apologize for my ignorance on the matter and with the help of you @Lucky Luke and @Graeme Donaldson I finally found the PC name and with nbtstat i found the IP... Thank you all for the help! – QuantumBITS Jun 7 '11 at 19:27

This was answered a while ago - My useraccount gets permanently locked by someone

  • Sounds like a different issue though ... – Lucky Luke Jun 7 '11 at 12:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.