Account Lockout logs

hi.

i have audit success event says:

-------------------------------------------

a user account locked out.

subject:

security id: system

account name: vsdcv001$

account domain: vs

logon id: 0x3e7

account locked out:

security id: vs\ssteners

account name: ssteners

additional information:

caller computer name: vsnbitsql001

---------------------------------------------

i'm assuming bad password causing this. thought these bad password events categorize under audit failure? log w2k8 server

---

freddy

hi,

you assume right, bad password events categorize under audit failure, event id 4625. locked account appears successful audit eventid 4740.

if case gets troublesome, try use account lockout tools along ad auditing. aware there can multitude of causes fot account lockouts. common ones (from experience):

- wrong password input user

- user changes password, , has cached credentials old password (check credentials in control panel , internet explorer)

- scheduled tasks , services running old password

- malware

- , list goes on....

---

tiago viana, mcitp:sa

Windows Server  >  Directory Services