DOH! Might not be a bad idea to check 4771's too. That with the spiffy tool that 'vbs' handed out via Susan may save the day.
From: Kennedy, Jim [mailto:[email protected]] Sent: Tuesday, March 17, 2009 9:49 AM To: NT System Admin Issues Subject: RE: Account lockouts Yes, I really meant 4776. From: Kennedy, Jim [mailto:[email protected]] Sent: Tuesday, March 17, 2009 9:39 AM To: NT System Admin Issues Subject: Account lockouts Still fighting our recent Conflicker outbreak. I have not seen any 4476's in the DC' event logs for days. So I turned our account lockout back on. Instantly a large number of accounts get locked out. Yet no 4476's. Any guesses how this happens, or where to look next? ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
