It is my job to review the logs. When reading a 644 event id log entry, whose user id will appear to be issueing the account lock out? Will it be Everyone? Should I expect to see a 644 event id log entry everytime an account lock out occurs? Is the appearance of a 644 event id log entry depends on certain settings? If yes, what settings or conditions? Thank you.

"Target" user account was locked out because of consecutive failed logon attempts exceeded lockout policy of domain - or in the case of local accounts the - local SAM's lockout policy. Reference: http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=644 So, the appearance of this event depends of your lockout policy and you will see it each time an account lockout accurs. http://technet.microsoft.com/en-us/library/cc737614%28WS.10%29.aspx This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

I understand what triggers the account lock-out. What is not clear to me is how come a 644 event id log entry does not appear in the log everytime an id geta lock out. I always see account unlock entries in the log when ever the administrator unlock an account based on a request from users but rarely encounter a 644 entry. Going back to my first question. When an account is unlock by the administrator, the administrator's id will appear as the user id that unlock the account. In the case of an account lock out, whose id will appear to have lock out the account? Thank you in advance to anyone who can be of help.

Hi, Generally speaking, account lockout occurs because of incorrect password attempts. The account is not locked out by someone but the lockout policy when the badPwdCount registry value is equal to or exceeds the LockoutThreshold value. The following articles could be helpful to better understand account lockout: http://technet.microsoft.com/en-us/library/cc780271(WS.10).aspx http://technet.microsoft.com/en-us/library/cc776964(WS.10).aspx http://technet.microsoft.com/en-us/library/cc773155(WS.10).aspx Hope it helps.This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.