Windows Server Security, activity log?
Discussion
Bit of a wierd one.
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
TIA
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
TIA
The Dude said:
Bit of a wierd one.
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
Yes, you can get locked out of a network for incorrect passwords - bear in mind it can for silly reasons like having mapped drives and you change your password and the cached password is then wrong and locks out the account. Number of password attempts/machine specific and stuff like that all depends on the setup of the network. However, I'd be surprised if it was foul play...if it was foul play, surely it would have happened more than twice over the course of a year? I know of users who have locked their accounts multiple times (like 10+) this year, and it's perfectly legit.
On the machine she's on, an admin can check the security event viewer and if it's logging, you can tell if the account was locked on that machine.
aranell said:
The Dude said:
Bit of a wierd one.
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
Yes, you can get locked out of a network for incorrect passwords - bear in mind it can for silly reasons like having mapped drives and you change your password and the cached password is then wrong and locks out the account. Number of password attempts/machine specific and stuff like that all depends on the setup of the network. However, I'd be surprised if it was foul play...if it was foul play, surely it would have happened more than twice over the course of a year? I know of users who have locked their accounts multiple times (like 10+) this year, and it's perfectly legit.
On the machine she's on, an admin can check the security event viewer and if it's logging, you can tell if the account was locked on that machine.
For the wrong-password-locking-out, is that several repeated attempts in a short space of time (less than 24 hours, say) or could it be 3 over the course of a year? The reason being, she could log in fine yesterday afternoon, nothing has been changed on their network (small office, IT outsourced and she knows they've not been onsite), this morning her first attempt to log on was met with that lock-out error....
The Dude said:
aranell said:
The Dude said:
Bit of a wierd one.
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
Yes, you can get locked out of a network for incorrect passwords - bear in mind it can for silly reasons like having mapped drives and you change your password and the cached password is then wrong and locks out the account. Number of password attempts/machine specific and stuff like that all depends on the setup of the network. However, I'd be surprised if it was foul play...if it was foul play, surely it would have happened more than twice over the course of a year? I know of users who have locked their accounts multiple times (like 10+) this year, and it's perfectly legit.
On the machine she's on, an admin can check the security event viewer and if it's logging, you can tell if the account was locked on that machine.
For the wrong-password-locking-out, is that several repeated attempts in a short space of time (less than 24 hours, say) or could it be 3 over the course of a year? The reason being, she could log in fine yesterday afternoon, nothing has been changed on their network (small office, IT outsourced and she knows they've not been onsite), this morning her first attempt to log on was met with that lock-out error....
The Dude said:
For the wrong-password-locking-out, is that several repeated attempts in a short space of time (less than 24 hours, say) or could it be 3 over the course of a year? The reason being, she could log in fine yesterday afternoon, nothing has been changed on their network (small office, IT outsourced and she knows they've not been onsite), this morning her first attempt to log on was met with that lock-out error....
As far as I understand it, it depends how the network is configured. Assuming a variety of things, the network admin can set the account lockout period to between 1 and 99,999 minutes. This is the time between when the counter is reset - so if it was set to 1 and you entered your password wrong once, the bad-password counter would be incremented. One minute after the bad password attempt, the bad-password counter would reset back to 0. I hope that sort of makes sense
The Dude said:
Bit of a wierd one.
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
TIA
Two times this year my other half has been "locked out of the system" at their office. The admin manager has told her that it's "probably because you mistyped your password 3 times" - she swears that she's never done that so she now suspects, and so do I, that there's some foul play going on - possibly someone trying to log onto her machine/the network using her name and trying to guess her password.
Can any Windows Server experts back any of this stuff up as I know nothing about it. Do you get locked out of the system for repeated wrong passwords? Is it machine specific or could someone have tried to use her log-in name on another terminal in the building? Does all this info get logged and if so, where to look for it? (They use a contract firm for IT management so it would be nice to be able to say to them "can you check xyz log to see when and where the log-in attempt was made?"
TIA
As has been said, this is likely to be related to her recently changing her password. 3 logon attempts before lockout is a pretty odd policy if you ask me (and is asking for a Denial of Service attack).
To answer your question, an event will be logged in the security event log (event ID 675) of the domain controller for each time the account was attempted to be logged on to.
The IT company will have to locate that record. The event log will include the date and time it was done, and from which workstation on the network.
It'll look something like this: www.adminprep.com/forums/Event_ID_675_%2D_Incorrect_Password_Processed_by_Kerberos/m_122/tm.htm
D
Edited by _deejay_ on Sunday 26th November 09:31
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff