Hi guys I'm seeing a 644 attempt to lock out administrator account on our DC's (2003 SP2). When i cross check the PC that caused the 644 I see the 4648. there doesn't seem to be many clues as to what caused the event on the PC though. All PC's on the domain are logging the same event and it looks like it happens when they start up and causing the 644 on the DC's . AV & MAlware scan are clean but I obvioulsy need to track down the cause. How can I dig deeper and find out the cause. Thanks inadvance for thoughts

Hi, Thanks for posting in Microsoft TechNet Forum. To troubleshoot account lockout issue, you could use the following tool to capture more data: Account Lockout Tools Troubleshooting Account Lockout Maintaining and Monitoring Account Lockout Download Details - Microsoft Download Center - Account Lockout Status (LockoutStatus.exe) Hope it helps. Alex Zhao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, I am just writing to check the status of this thread. Was the information provided in previous reply helpful to you? Do you have any further questions or concerns? Please feel free to let us know. Alex Zhao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi, As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios. If the issue still persists, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish. BTW, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts. Regards, Alex Zhao TechNet Subscriber Support in forum If you have any feedback on our support, please contact tnmff@microsoft.com.Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.