See machine that account is been locked - y2k

[Guest]

We have a domain with about 50 dc's and sometimes our domain account is
locking after a hour or so that we just unchecked the lockout propertie. We
need to know what is the machine is causing this. Do we have any script to
get this from the domain controllers ? since we have a lot of domain
controller check one by one would be hard.

 

[Tim.Olsen]

Bruno,

Get MS's Account Lockout and Management Tools; they're free.
http://www.microsoft.com/downloads/...familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e

You can use Lockoutstatus to track which domain controller processed
the lockout
and you can use Eventcomb to search the logs on that domain controller
to pinpoint the IP address of the computer where the bad passwords are
coming from.

Regards
Tim.Olsen