Account Locked with No Security Events
Hello,
We recently lost a network administrator and have changed the passwords for administrator accounts. Unfortunately, there is some service/application/sql process that is unsuccessfully trying to authenticate in AD. What makes this troubleshooting process more difficult is there are no failure events in the security log on the 2008 domain controllers.
Any ideas on how to monitor for the source of these unsuccessfull logon attempts?
Any help would be greatly appreciated.
Thank you
David
January 13th, 2010 10:04pm
Hi David,
Thanks for your post in Windows Server Forum.
You may use Account Lockout and management Tools to help isolate the root cause of this issue.
Account Lockout and Management Tools
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
For more information, please refer to:
Troubleshooting account lockout problems in Windows Server 2003, in Windows 2000, and in Windows NT 4.0
http://support.microsoft.com/default.aspx?scid=kb;EN-US;315585
User accounts are unexpectedly locked, and event ID 12294 is logged in Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;EN-US;887433
Best Regards,
Wilson JiaThis posting is provided "AS IS" with no warranties, and confers no rights.
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2010 4:36am