I've just found event ID 12294 on one of our domain controllers. It occured on Saturday (20th) at 4:00 AM ... when the user was not at work ... and the likelyhood of anybody being at work was very slim. I've just spoken with the user and she said that when she came in this morning, her account was locked out (even thought it should have become unlocked by now).
I can understand that maybe somebody tried to guess her password etc, but what I'm more concerned about the fact that the account could not be locked out. I've searched for Event ID 12294 and there has been 12 since May 2005 - with various different accounts. I also searched for the same event ID on another DC, and found two instances of it, both of which said the account was Administrator - I always thought the build in Administrator account was except from being locked out?
Are there any diagnostics I can run to check if AD is corrupt or anything like that? Would really appreciate some help on this.
Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau
I can understand that maybe somebody tried to guess her password etc, but what I'm more concerned about the fact that the account could not be locked out. I've searched for Event ID 12294 and there has been 12 since May 2005 - with various different accounts. I also searched for the same event ID on another DC, and found two instances of it, both of which said the account was Administrator - I always thought the build in Administrator account was except from being locked out?
Are there any diagnostics I can run to check if AD is corrupt or anything like that? Would really appreciate some help on this.
Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau
