User Monitoring

[Guest]

HI
I've a userid which is used to run varos applications today i've enforced
password polcy for the domain where as set in the account lockout option and
out of the blue this account is locked out twice.Is there any utility thru
which i can monitor activity of a single user and track down how is this
getting locked and who is initiating this..

Urgent help in this regard is awaited..


Rajnish

 

[Cary Shultz [A.D. MVP]]

Rajnish,

Is the user account / password hard-coded in the applications? Is this user
account object also used by any services? That would normally require you
to include a password. This could also be the problem.

You might want to look at the Account Lockout utilities that MS has
available on its web site. There are a couple of really good utilities
there.

Here are two useful links:

http://www.microsoft.com/downloads/...90-a13b-4977-a4fc-3e2b67e3748e&displaylang=en
http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Does this help?

--
Cary W. Shultz
Roanoke, VA 24012

WIN2000 Active Directory MVP
http://www.activedirectory-win2000.com
(soon to be updated!!!)
http://www.grouppolicy-win2000.com
(soon to be updated!!!)

 

[Guest]

The event log will help you determine which workstation/server the lockout
occurred from. If the apps which use this account are installed on different
servers, then this may help you track down the source of the lockouts.

If you've a handful of DC's, you should be able to scan through the security
logs and find the lockout event manually. If you've got more DC's, you could
write some scripts to capture those events and drop them in a single location
where you can browse the lockouts together. Personally, I gather lockout
information, post it to a database, then view the list through a web page.