Account Unlock Log

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a requirement to be able to track when/who unlocks accounts on Active
Directory. Is there a log kept that I can tap into, or a utility that will
let me access this information.
 
I have a requirement to be able to track when/who unlocks
accounts on Active
Directory. Is there a log kept that I can tap into, or a
utility that will
let me access this information.
Click to expand...

You focus Microsoft Management Console (MMC) snap-ins against a
specific domain controller that is referenced by its IP address. For
example, you click Start, click Run, and then type the following
command:
for Active Directory User and Computers
dsa.msc /server=ipaddress

With thw above you only have to search ONE DC for the event id for
account unlocks, otherwise you need to know which DC the person used
in the MMC to unlock the account

Then check the security event log for event ids that reference the
unlock actions. event id = 671 -> designates the account UNLOCK!

event id 644 is the id that logs the account lockout (use
eventcombmt.exe to check all security logs on all DCs if you want to
know this)

you also need to enable "Account Management – Success" on the DCs
At OU level you need to audit for:
Read/Write lockouttime for user objects

Cheers,
 
Back
Top