Find location of bad password 2

[JPJeffery]

We have a user whose account keeps getting locked out.

In my experience this us usually because they've left themselves logged in a PC_A then logged on and changed their password on PC_B.

And in the past I proved the bad password was being issued from PC_A like this:

c:\nltest /user:bloggs_j /server:PDC_Name

...to give me the time of the account lockout, then a search of the event logs on the PDC (or PDC emulator) at that time to find the erroneous PC name.

However, I get this error when I run it now-a-days:

Cannot open SAM\SAM\Domains\Account\Users\Names\anthony_j Status = 2 0x2 ERROR_FILE_NOT_FOUND

I've searched on t'internet for a solution without much luck (although I did find an old thread I started on

http://www.winserverkb.com

when I first got this error but the fix there didn't work this time around).

So, does anyone know of a fix for this OR an alternative method of identifying where a bad password is being issued from?

Environment is Windows XP clients and Server 2003 servers.

JJ
[small][purple]Variables won't. Constants aren't[/purple]
There is no apostrophe in the plural of PC (or PST, or CPU, or HDD, or FDD, and so on)[/small]

 

[allywilson]

Audit logging

 

[kmills]

JP,
I use the AcctInfo.dll to track down problems like you describe. It gives logon and password information. If you have more than one domain controller, you can change the one you are looking at.

In the Additional Account Info tab that is added to Users & Computers, note the times involved & look at the event viewer on each domain controller.

http://www.petri.co.il/view_additional_user_information_in_aduc.htm

gives you more info about this useful tool.