account lockout unable to determine what is... Expand / Collapse
Author
Message
Posted 8/23/2018 9:16:32 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/23/2018 9:12:40 AM
Posts: 1, Visits: 0
i have a system where the Adminstrator account is being locked a ton.
i have tan "NEtwrix Account Lockout" and it doesnt find anything.

the logs do not point me in a good direction:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 8/23/2018 8:56:53 AM
Event ID: 4740
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: SERVER-DC..LOCAL
Description:
A user account was locked out.

Subject:
Security ID: SYSTEM
Account Name: SERVER-DC$
Account Domain:
Logon ID: 0x3e7

Account That Was Locked Out:
Security ID: \Administrator
Account Name: Administrator

Additional Information:
Caller Computer Name:
Event Xml:



4740
0
0
13824
0
0x8020000000000000

1376915243


Security
SERVER-DC..LOCAL



Administrator


S-1-5-21-1856253067-866462314-1234779376-500
S-1-5-18
SERVER-DC$

0x3e7



i have looked for scheduled task there are none
looked at services nothing using Administrator.

if anyone can point me a good direction?
Post #8491
Posted 8/27/2018 5:26:13 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 223, Visits: 0
Have you reviewed the authentication and login failure events for this user? I would review those to see if that can help identify the source of the lockout.
Post #8494
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:48am