Tracking down account lockouts

[rop.jason]

From a domain controller, is there a way to see which workstation
incorrect logins/account lockouts are coming from? Everything I can
find says you have to go to the workstation to identify what is
generating the incorrect logins. I don't care so much at this point
what is generating them, I need to identify the workstation they are
coming from.

Thanks
Jason

 

[Jorge de Almeida Pinto [MVP - DS]]

use NETLOGON debug logging

Enabling debug logging for the Net Logon service
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag
DBFlag = 0x2080FFFF (in: %windir%\debug\netlogon.log)


google for "NETLOGON debug logging" and you will find more info

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx