Account Lock Policy

[k3lvin]

I have been asked to create a Account Lockout Group Policy, so I have with the following poicy settings:

Account lockout duration - 30 mins
Accountl ockout threshold - 5 invalid logon attempts
Reset account lockout counter after 30 minutes

I have set this in our Default Domain Policy (I only use this GPO for this policy and password policy) and have not enforced it so that it won't effect our servers, DC's, admin OU's that are set to block inheritance (all our servers and administrative accounts) The problem is, since I have created this policy our "admin" account (domain\admin) which is used a fair amount on our servers and occasuanly gets locked out. So there must be a pc out there that has something like a service using our admin account with an old password? If I run rsop.msc on a server in our Servers OU the account lock out policy is not applied. Is there a way of viewing what or how this account is getting locked out?

 

[paladin256]

Enable auditing for failed logons you will then be able to see an entry in the event log under security. Look at the event it might give you the workstation but it should give you the IP address and you can track it back from there. I would also avoid making changes to the default domain policy and instead make a separate policy.

 

[technome]

Also...

"Account lockout duration - 30 mins
Accountn lockout threshold - 5 invalid logon attempts Reset account lockout counter after 30 minutes"

I would rethink the duration and reset lockout duration, both good to set, primarily against a dictionary attack but 5 minutes on both would suffice.

........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[k3lvin]

I installed Account Lockout and Management Tools, ran eventcombMT.exe, added my DC's, ticked all boxes except the bottom one (Get All Events With…)

Searched with the following Event IDs: 529 644 675 676 681 12294

Log files should go into C:\temp\

Look at the DCnamehere-Security_LOG.txt file(s) and look for entries with “Account Locked Out:” this will tell what computer is trying is causing the account to lock out.