Powered by Blogger.
RSS

Finding cause of locked-out Active Directory Accounts

Finding cause of locked-out Active Directory Accounts

(This was posted by Chris Conklin. Can't seem to find his blog anymore, but this information I use over and over again, so I thought to post here.)
Had this problem again today, and in the search for relevant event IDs found a set of Microsoft Tools from 2003 that I can’t believe I’ve not come across earlier.
The important tools to me,
  1. LockoutStatus.exe – simply File->Select target, enter short login name.  It queries for all DCs – then checks status on all. LockoutStatus
  2. Ok, that would then allow me to grep… err, filter the security event log on the locked DC for what machine made the invalid login request and caused the lockout.  But THREE log files… Meh.  So we fire up the next tool – EventCombMT.exe  Again, what are the event IDs… back to Goog… err, wait – Searchs->Built in Searches –> Account Lockouts       EventCombMT
  3. well not-so-fast, three-digit EventIDs are Sooooo WindowsXP/2003.  Back to the Googles after-all.  So enter EventID 4740, click Search and you are golden.  (in my example below – I’m only searching ITS-DC1 since LockoutStatus shows the last BadPwd was on my PDC Emulator)EventCombMT2
  4. You get two output files in temp, EventCombMT.txt  and the more interesting %DCNAME%-Security_LOG.txt – the file gives you the dope you want in columns: Caller Computer Name (NetBIOS name of workstation that entered the final bad password attempt), and of course time, date, and Account Name .

  • Digg
  • Del.icio.us
  • StumbleUpon
  • Reddit
  • RSS

2 comments:

madin said...

Deze replica Moncler-jurk is van een perfecte kwaliteit en comfortabel om te dragen.Goedkope Moncler jassen Hij draagt niet je voeten tijdens het reizen. Ik adviseerde deze site aan mijn goede vrienden, Goedkope Moncler kinderen overhemden polos ze zijn erg blij, kunnen zulke goedkope Moncler-kleding kopen.

Slc Nanny said...

나누미 검증 추천 | 바둑이사이트 현금바둑이 딱 2곳만 추천 가장 안전하고 정직하며 신속한 바둑이사이트를 메이저 중에서도 메이저로 만나실 수 있습니다 한국을 대표하는 바둑이게임 더 이상의 바둑이사이튼 절대 없습니다 먹튀검증사이트 나누미 추천은 정확합니다 자세한 내용은 웹 사이트를 방문하십시오 현금바둑이.

Post a Comment