2

I'm having trobule at work with an AD account (let's call it USER A) that keeps locking out all the time. Using ALTools I figured it out the computer where the lockout is coming from, it's a 2008 R2 Server which hosts an application citrix like, so users remotely login to the app using terminal services.

The thing is I can't know where the lockout is coming from (process, application, service, user account, etc), because the user in question has no login attempts on the server, neither has a user profile on it, so my guess is that another user is using User A credentials from inside his session.

Can anybody help me finding the origin of the lockout?

Thank you!

1

1 Answer 1

1

Were you referring to using ALockout.dll within the ALTools?

https://technet.microsoft.com/en-us/library/cc738772%28WS.10%29.aspx The ALockout.dll tool and the Appinit.reg script are included in the ALTools package. ALockout.dll is a logging tool that may help you determine the program or process that is sending the incorrect credentials in an account lockout scenario. The tool attaches itself to a variety of function calls that a process might use for authentication. The tool then saves information about the program or process that is making those calls into the Systemroot\Debug\Alockout.txt file. The events are time stamped so that you can match them to the events that are logged in either the Netlogon log files or the Security event log files.

I want to mention it to make sure it wasn't missed

1
  • WOW I ABSOLUTELY MISSED THAT!! thank you! The only problem I have is I can't reboot the server for it is a productive one. Any idea?
    – Black Lion
    Jan 26, 2016 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .