Use tool provided by MS called "eventcombMT.exe". Get a domain controller name of (using set command from logged on m/c) account which is frequently getting locked and run eventcombMT.exe on same domain controller. Use in build query of tool called ACCOUNT LOCKOUT (Search-bulit in searches-->account lockout). This query will check "529 644 675 676 681" events in domain controller which are associated with account lockout . You will get output in txt format and it gives you IP Address from where account lockout is coming in.
-Dinesh Regards, Dinesh Tashildar Ext:3119 | Vnet 23119 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John Parker Sent: Thursday, May 12, 2005 10:31 PM To: [email protected] Subject: RE: [ActiveDir] Lockouts Please forward the script. I would be very appreciative. Thank you. John Parker, MCSE IS Admin. Senior Technical Specialist Alpha Display Systems. Alpha Video 7711 Computer Ave. Edina, MN. 55435 952-896-9898 Local 800-388-0008 Watts 952-896-9899 Fax 612-804-8769 Cell 952-841-3327 Direct [EMAIL PROTECTED] "Be excellent to each other" ---End of Line--- -----Original Message----- From: Medeiros, Jose [mailto:[EMAIL PROTECTED] Sent: Thursday, May 12, 2005 11:54 AM To: [email protected] Subject: RE: [ActiveDir] Lockouts Hi John, Try using the usrstat.exe tool out of the NT4 or 2000 resource kit and pipe the output to a text file. Or you can use a complex VB script to do the same thing. I can forward you the VB script if thats what you prefer. Sincerely, Jose Medeiros MCP+I, MCSE, NT4 MCT www.ntea.net www.tvnug.org www.sfntug.org ------------------------------------------------------ -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of John Parker Sent: Thursday, May 12, 2005 9:40 AM To: [email protected] Subject: [ActiveDir] Lockouts Hello all... I am running Active Directory on a 2000 Server fully spacked. I have users (Random) getting locked out frequently. While I am searching for reasons as to why this is happening, I am curious if there are any tools that will show me my user's status. I using MS's account lockout tool, but it only shows me one user at a time. I would like to see all at once. Any tools like that out there? Anyone experienced this? I can find nothing of note in my event logs either. Thanks John Parker, MCSE IS Admin. Senior Technical Specialist Alpha Display Systems. Alpha Video NOTICE OF CONFIDENTIALITY This document and its attachments are intended for the named addressee(s) only. They contain information which may be Confidential, privileged and/or exempt from disclosure. Unless you are the named addressee (or authorized to receive this document and/or its attachment(s) or its contents on behalf of the addressee,) you may not read, copy, use, or disclose the document and/or its attachment(s) or its contents. The unauthorized use, copying or disclosure of this document and/or its attachment(s) or its contents is strictly prohibited and may be unlawful. Alpha Video and Audio inc. disclaims any responsibility in relation to the information in this e-mail message. No rights can be derived from this message. Messages and attachments are not scanned for all known viruses. If you have received this document and/or its attachment(s) by mistake, please notify the sender by telephone immediately at 952-896-9898 or by e-mail at [EMAIL PROTECTED] and destroy immediately all physical and/or electronic copies of the document and its attachment(s). List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ NOTICE OF CONFIDENTIALITY This document and its attachments are intended for the named addressee(s) only. They contain information which may be Confidential, privileged and/or exempt from disclosure. Unless you are the named addressee (or authorized to receive this document and/or its attachment(s) or its contents on behalf of the addressee,) you may not read, copy, use, or disclose the document and/or its attachment(s) or its contents. The unauthorized use, copying or disclosure of this document and/or its attachment(s) or its contents is strictly prohibited and may be unlawful. Alpha Video and Audio inc. disclaims any responsibility in relation to the information in this e-mail message. No rights can be derived from this message. Messages and attachments are not scanned for all known viruses. If you have received this document and/or its attachment(s) by mistake, please notify the sender by telephone immediately at 952-896-9898 or by e-mail at [EMAIL PROTECTED] and destroy immediately all physical and/or electronic copies of the document and its attachment(s). List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may contain confidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Any unauthorised review, use, disclosure, dissemination, forwarding, printing or copying of this email or any action taken in reliance on this e-mail is strictly prohibited and may be unlawful. Visit us at http://www.cognizant.com List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
