Re: aduiting user acount

Hi,

Even i too had the same problem. My users get locked often without any
reason.But i found that this was not happening due to wrong passwords.I tried
to use a account lock out tool which i download from the microsoft site. But
that proved to be of no use. Now i am using a new server with new domain. Now
i dont have any problems. I did this in no way.


"gokhanbeler" wrote:

> Hello,
> I told that I could review security logs on either of DCs. What else do I
> have to do to turn on.However I could not see any ip of the client. The
> computer that user log on is XP home edition and reformated.there is a
> outlook 2003 running on this computer.
> How can I find out what process locks out this account? Shall I checkout DC
> or Local computer's security log. By the way, is there way to make this user
> account authenticate with only one DC it's hard to search for security logs
> of both DCs
>
> "Kevin D. Goodknecht Sr. [MVP]" wrote:
>
> > gokhanbeler <gokhanbeler@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > > I got 3 domain controllers in our domain. I configured audit policy
> > > settings for user account events. When I review corresponding user
> > > events in security logs on either of domain controllers. I have to
> > > check out security logs of all domain controllers. This method is
> > > very time-consuming and not successful. What exactly I need to do is
> > > to learn why specific user's account is locked sometimes. which
> > > process lock out this user's account. How to monitor this user's
> > > activities.
> > > My suggestion: Just auditting his own computer could not be good idea.
> > > Because this user account may run the service on another computer
> > > which I don't know.
> > > If this is the case How can I find out?
> > > System administrators, please help
> > >
> > > I would be grateful...
> >
> > Do you have auditing turned on in the security log?
> > When a client connects to a DC to authenticate, it will create an entry in
> > the security log, giving the IP of the client.
> > I would first suspect a scheduled task with the wrong passoword, but it
> > could also be a saved in the Advanced tab of user accounts in XP. (Click the
> > manage passwords button)
> >
> >
> > --
> > Best regards,
> > Kevin D. Goodknecht Sr. [MVP]
> > Hope This Helps
> > ===================================
> > When responding to posts, please "Reply to Group"
> > via your newsreader so that others may learn and
> > benefit from your issue, to respond directly to
> > me remove the nospam. from my email address.
> > ===================================
> > http://www.lonestaramerica.com/
> > http://support.wftx.us/
> > https://secure.lsaol.com/
> > ===================================
> > Use Outlook Express?... Get OE_Quotefix:
> > It will strip signature out and more
> > http://home.in.tum.de/~jain/software/oe-quotefix/
> > ===================================
> > Keep a back up of your OE settings and folders
> > with OEBackup:
> > http://www.oehelp.com/OEBackup/Default.aspx
> > ===================================
> >
> >
> >
.