Account Lockout event log only recorded ... sometimes

[Guest]

Hello,

I've got my policy set up on Account Management success and Failure and I
have been getting records in the event log when user accounts lock out (a
644 event) and I still get them, but it seems to be a hit-or-miss thing
recently. If I weren't getting any, I would think the policy wasn't right,
but it's an intermittent issue. I know about the event log bug, and I
archive the logs with a VBscript every night so they don't get too big and
start dropping them, but there is at least one account, and probably more,
that is not recording the event of its locking out, and I need to see those
so I can inform the developer the originating machine name.

Any ideas?

 

[Meinolf Weber]

Hello -,

Do you have more than one DC and check all of them?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm

 

[Guest]

Yes. I have checked the logs on all 7 DC's in the domain right after I see
that it's locked, and there's no 644 or 642 on that account on any of the 7
DC's. There are other accounts with 644's and 642's but not this one.