Locked workstation bad login attempts event log entries for?

[vincehoran]

Whilst reviewing the security of my network, I am unable to locate
Failure Audit messages for incorrect passwords login attempts on a
Windows XP in locked workstation state. The computer is on a Windows
2000 active directory domain and I am logging on to a active directory
domain account. Should there not be a failure audit message in either
the event log of the XP box or in the event log of one of the domain
controllers?

Vince Horan

 

[Paul Williams [MVP]]

If you have that auditing enabled, there will be events on the
authenticating DC.

To give you a heads up on which DC is doing the authenticating, download and
run the Account Lockout Tools from Microsoft.