Locked out accounts

[fuunstatic]

is there a way of seeing which accounts are locked out in the event viewer and take immediate action to unlock them,
instead of waiting for the users to call Admin support to get them unlocked

or are we talking about 3rd party tools here to plug into the active directory to do this

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"

 

[ksukenny]

you could turn on auditing and audit failed login attempts, but someone would have to be monitoring the event viewer and keep track of failed attempts


why would you want to do this though? seems like a security problem to me. what if someone was attempting to login using someone else's account and you kept unlocking the account without speaking to the actual user whose account it is. to each his own, but doesn't sound like a good idea to me.

 

[fuunstatic]

agreed however this was a question posed to me and not something we would have undertaken.

the real reason I am asking is that we are auditing failed login attempts and the admin users report their accounts locked out yet there is no security log entry

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"

 

[ksukenny]

ummmm, do you just have one domain?

 

[fuunstatic]

yes one domain, problem has been sorted now

user was not logging into the domain being monitored

thanks for your help

"Work to live, don't live to work"

"The problem with troubleshooting is that sometimes it shoots back"

 

[jrIStech]

-talk to your admin about logging rights and ask him if he can change it so you won't get locked out after a few unsuccessful login
*but you gotta understand the admins probably did it for a reason, they WANT YOU TO BE CAREFUL when you do ANY kind of work; just take your time