Account Locked with No Security Events
Hello, We recently lost a network administrator and have changed the passwords for administrator accounts. Unfortunately, there is some service/application/sql process that is unsuccessfully trying to authenticate in AD. What makes this troubleshooting process more difficult is there are no failure events in the security log on the 2008 domain controllers. Any ideas on how to monitor for the source of these unsuccessfull logon attempts? Any help would be greatly appreciated. Thank you David
January 13th, 2010 10:04pm

Hi David, Thanks for your post in Windows Server Forum. You may use Account Lockout and management Tools to help isolate the root cause of this issue. Account Lockout and Management Tools http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en For more information, please refer to: Troubleshooting account lockout problems in Windows Server 2003, in Windows 2000, and in Windows NT 4.0 http://support.microsoft.com/default.aspx?scid=kb;EN-US;315585 User accounts are unexpectedly locked, and event ID 12294 is logged in Windows Server 2003 http://support.microsoft.com/default.aspx?scid=kb;EN-US;887433 Best Regards, Wilson JiaThis posting is provided "AS IS" with no warranties, and confers no rights.
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2010 4:36am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics