Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Active Directory (Windows)

Options
  • 10-12-2009 1:15pm
    #1
    nd2no
    Registered Users Posts: 73 ✭✭


    Hi All,

    Just wondering if anyone knows about event ID'd within security log of 2003 server? I ma trying to audit bad passwords on our network Event ID 675. When a user enters a bad password loggin onto a machine it triggers event id 675 with service name krbtgt\domain, after 4 attempts they are locked out.

    However during the course off the day I am noticing the same event ID trigger maybe 20 times a day with no lockout. The only difference is the event ID has a service name of krbtgt\domain.net.local. Anyone know why their is a differnce in service names within the event ID?


Comments

  • Options
    #2
    mada999
    Registered Users Posts: 7,080 ✭✭✭mada999


    grab altools from the web and use the 'LockoutStatus.exe' to find out what DC it is getting locked out from... check the event logs of hte DC to find out where the account is getting locked from

    happened me before... i had some stored cached credentials for RDP


  • Options
    #3
    aidan_walsh
    Closed Accounts Posts: 17,208 ✭✭✭✭aidan_walsh


    Not really the right forum for this, as well as being ye olde bump.


This discussion has been closed.
Advertisement