Re: aduiting user acount

gokhanbeler <gokhanbeler@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> Hello,
> I told that I could review security logs on either of DCs. What else
> do I have to do to turn on.However I could not see any ip of the
> client.
Look for a failure entries on DCs. All failure audits have either the
workstation name or IP address. You can filter the failures in the event
log.


>The computer that user log on is XP home edition and
> reformated.there is a outlook 2003 running on this computer.
> How can I find out what process locks out this account?

There may be a way to do this from the client, but I don't know of it. On
Windows server OS's, IIS logs its account failures in the system log and
Exchange logs its Account failures in the Application log.

> Shall I
> checkout DC or Local computer's security log. By the way, is there
> way to make this user account authenticate with only one DC it's hard
> to search for security logs of both DCs

It won't be in the local computer's security log.

In control panel, User Accounts, select the Advanced tab, click the manage
passwords button, you will see a list of sites and servers with saved
passwords. Delete or edit entries for the server's name.
Since this is XP Home I would supect it would have to be a saved password,
because XP home cannot authenticate with a domain any other way, other than
as a guest.



--?
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This Helps
===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
https://secure.lsaol.com/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
===================================


.