Account Lockout event log only recorded ... sometimes

[Guest]

Hello,

I've got my policy set up on Account Management success and Failure and I
have been getting records in the event log when user accounts lock out (a
644 event) and I still get them, but it seems to be a hit-or-miss thing
recently. If I weren't getting any, I would think the policy wasn't right,
but it's an intermittent issue. I know about the event log bug, and I
archive the logs with a VBscript every night so they don't get too big and
start dropping them, but there is at least one account, and probably more,
that is not recording the event of its locking out, and I need to see those
so I can inform the developer the originating machine name.

Any ideas?

 

[Meinolf Weber]

Hello -,

Do you have more than one DC and check all of them?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm

> Hello,
>
> I've got my policy set up on Account Management success and Failure
> and I have been getting records in the event log when user accounts
> lock out (a 644 event) and I still get them, but it seems to be a
> hit-or-miss thing recently. If I weren't getting any, I would think
> the policy wasn't right, but it's an intermittent issue. I know about
> the event log bug, and I archive the logs with a VBscript every night
> so they don't get too big and start dropping them, but there is at
> least one account, and probably more, that is not recording the event
> of its locking out, and I need to see those so I can inform the
> developer the originating machine name.
>
> Any ideas?
>

 

[Guest]

Yes. I have checked the logs on all 7 DC's in the domain right after I see
that it's locked, and there's no 644 or 642 on that account on any of the 7
DC's. There are other accounts with 644's and 642's but not this one.


"Meinolf Weber" <meiweb(nospam)@gmx.de> wrote in message
news:ff16fb66745f08ca0d5cc5572375@msnews.microsoft.com...
> Hello -,
>
> Do you have more than one DC and check all of them?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.dts-l.org/goodpost.htm
>
>> Hello,
>>
>> I've got my policy set up on Account Management success and Failure
>> and I have been getting records in the event log when user accounts
>> lock out (a 644 event) and I still get them, but it seems to be a
>> hit-or-miss thing recently. If I weren't getting any, I would think
>> the policy wasn't right, but it's an intermittent issue. I know about
>> the event log bug, and I archive the logs with a VBscript every night
>> so they don't get too big and start dropping them, but there is at
>> least one account, and probably more, that is not recording the event
>> of its locking out, and I need to see those so I can inform the
>> developer the originating machine name.
>>
>> Any ideas?
>>
>
>