Subject: Security ID: S-1-5-18 Account Name: DC-PRIMARY$ Account Domain: Corp Logon ID: 0x3e7 -Īccount That Was Locked Out: Security ID: S-1-5-21-4144105501-2967912833-963096433-4827 -Īccount Name: userAdmin Additional Information: Caller Computer Name: WEBSERVER-01 The output will look similar to this (I added carriage returns for readability) : 4740,AUDIT SUCCESS,Microsoft-Windows-Security-Auditing,Wed Sep 18 04:05:49 2013,No User,A user account was locked out.
It will take a few minutes to run and produce and output file of all accounts that have been locked.
The settings I used in the EventComb tool were as follows: I managed to track down the box that was locking my account using this awesome tool EventComb. Turns out I had a scheduled task running on a remote server on Alderaan that was mistakenly hard-coded to my old ID.
0 kommentar(er)
