Auditing 1 user account

[john]

Is there a way of logging when 1 user in AD attempts to
logon, btoh success and failure. They may use any number
of machines, so it must be account related not machine
related. The reason is, the account keeps getting
locked, as if something else is trying to logon using it
and fails, and it keeps happening. I need to log the use
of the account so I can see if something else is trying
to use it to logon.

Thanks

John

 

[Matjaz Ladava]

Yes It is possible to log user logon activity. You do this trough setting
Auditing in domain controler GPO. You will see the entries in Security Log
in your Event Log. There is an excelent article about account lockout
problems located at
http://www.microsoft.com/technet/tr...ndowsserver2003/maintain/operate/BPACTLCK.asp

--
Regards

Matjaz Ladava, MCSE (NT4 & 2000)
(e-mail address removed)
http://ladava.com