I'm trying to track down the source of a repeated account lockout. My DCs are Server 2008, Server 2008 R2, and Server 2003. I'm running EventCombMT in order to do this, but it's giving me "Access is denied" on every DC other than the one that's in the site I'm running the tool from (I'm running it on a Win7 SP1 machine, if that matters). I'm running the tool with elevated privileges (if you don't, it won't let you select the security logs to search). Any ideas why EventCombMT is unable to access the logs of my servers? Or any suggestions on a different way for me to figure out the source of the lockouts?

Hi, According the system requirements on the following article, I suggest you run EventCombMt tool on Windows Server 2003. Account Lockout and Management Tools http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 Meanwhile, the ID of account lockout event is 4740 in Windows Server 2008 and Windows Server 2008 R2. For the description of security events in Windows Server 2008 and Windows Server 2008 R2, please refer to the following articles: http://support.microsoft.com/kb/947226 http://support.microsoft.com/kb/977519 Hope this helps. Regards, Bruce Forum Support Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

Running the tool from a DC eliminated the error. Although interestingly, the tool reported no lockouts. I know that to be false, though, because the account WAS locked out multiple times (I'd unlock it, and minutes later it would be locked again). I did include event ID 4740 along with the defaults for searching logs for lockouts.