Locked workstation bad login attempts event log entries for?

  • Thread starter Thread starter vincehoran
  • Start date Start date
V

vincehoran

Whilst reviewing the security of my network, I am unable to locate
Failure Audit messages for incorrect passwords login attempts on a
Windows XP in locked workstation state. The computer is on a Windows
2000 active directory domain and I am logging on to a active directory
domain account. Should there not be a failure audit message in either
the event log of the XP box or in the event log of one of the domain
controllers?

Vince Horan
 
If you have that auditing enabled, there will be events on the
authenticating DC.

To give you a heads up on which DC is doing the authenticating, download and
run the Account Lockout Tools from Microsoft.
 
You must log in or register to reply here.

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

How to check bad password login in Windows 2003 domain controller? 1
Event ID# on Domain Controllers for workstation interactive logon 4
Security Auditing 1
Directory Service Access 2
advapi failed login locking account 1
Users in Win98 workstations having account locked in Active Direct 5
unnecesarry event ID 537 1
Windows 2000 domain / Account logon auditing 1

Back
Top