Searching Windows 2003 DC's eventlog for wrong passwords and account lockouts

[Chris Henderson]

Hi All,

I was wondering what tools people use to do this. We have a lot of users on
our systems and many bad logon attempts. Can anybody tell me of a utility
that might be able to go through the kerberos ticket information and allow
me to search for usernames that had account lockouts or bad password
attempt?

Thanks in advance,

Chris

 

[Jeff Cochran]

I was wondering what tools people use to do this. We have a lot of users on
our systems and many bad logon attempts. Can anybody tell me of a utility
that might be able to go through the kerberos ticket information and allow
me to search for usernames that had account lockouts or bad password
attempt?

Take a look at Microsoft's Log Parser. At logparser.com of course.


Jeff

 

[Steven L Umbach]

The free Eventcomb utility from MS works pretty well and allows you to
search multiple computers for specific events and text strings. For more
info and where to get it see the link below. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;824209

 

[Chris Henderson]

Thanks very much Jeff and Steven, both those utilities work great.

Chris