Audit Failure Codes

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hello:
Is there a place I can find what the Account Logon Failure Codes and Event
Codes mean?

I have recently had a problem with Member Server that caused a large number
of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
account out but never generated the Account Lockout code I usually see when
an account reaches the Lockout threshold. Service Name: (mostly) Host/DC or
later Member Server. I did change password 3 days prior and do have mapped
drives, but had no difficultly logging onto Server.

Thanks,
 
If you have not done such yet enable auditing of account management in
Domain Controller Security policy and look in the security log of the pdc
fsmo for account lockouts. The links below should be helpful including to
tools and a white paper on account lockouts. --- Steve

http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
http://tinyurl.com/68qbj -- same link, shorter.

http://www.microsoft.com/technet/security/guidance/secmod144.mspx --
Auditing and intrusion detection.

http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.0&LCID=1033
http://tinyurl.com/6autp -- same link, shorter. Search for Event ID's.
 
Back
Top