|
|
|
Forum Newbie
Group: Forum Members
Last Login: 8/23/2018 9:12:40 AM
Posts: 1,
Visits: 0
|
|
i have a system where the Adminstrator account is being locked a ton.
i have tan "NEtwrix Account Lockout" and it doesnt find anything.
the logs do not point me in a good direction:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 8/23/2018 8:56:53 AM
Event ID: 4740
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: SERVER-DC..LOCAL
Description:
A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: SERVER-DC$
Account Domain:
Logon ID: 0x3e7
Account That Was Locked Out:
Security ID: \Administrator
Account Name: Administrator
Additional Information:
Caller Computer Name:
Event Xml:
4740
0
0
13824
0
0x8020000000000000
1376915243
Security
SERVER-DC..LOCAL
Administrator
S-1-5-21-1856253067-866462314-1234779376-500
S-1-5-18
SERVER-DC$
0x3e7
i have looked for scheduled task there are none
looked at services nothing using Administrator.
if anyone can point me a good direction?
|
|
|
|
|
Supreme Being
Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 234,
Visits: 0
|
|
| Have you reviewed the authentication and login failure events for this user? I would review those to see if that can help identify the source of the lockout.
|
|
|
|