Accounts Repeatedly Getting Locked Out? Try the Account Lockout Tools...
Sometimes a recurring process or other mechanism finds itself with a bad user or service password. When that happens, often the result is a regularly locked out account. Tracking down these problems can be maddening, with the Security event log providing virtually no help.
But, while at the Minasi Forum in Virginia Beach this week, I talked with an attendee who reminded me about Microsoft's account lockout toolset. This free download from Microsoft includes a set of tools that you can use to track down those nasty repeated lockouts. None are a magic bullet, but all in combination provide an elevated situational awareness of the problem.
The tools include...
- AcctInfo.dll. Helps isolate and troubleshoot account lockouts and to change a user's password on a domain controller in that user's site. It works by adding new property pages to user objects in the Active Directory Users and Computers Microsoft Management Console (MMC).
- ALockout.dll. On the client computer, helps determine a process or application that is sending wrong credentials. Caution: Do not use this tool on servers that host network applications or services. Also, you should not use ALockout.dll on Exchange servers, because it may prevent the Exchange store from starting.
- ALoInfo.exe. Displays all user account names and the age of their passwords.
- EnableKerbLog.vbs. Used as a startup script, allows Kerberos to log on to all your clients that run Windows 2000 and later.
- EventCombMT.exe. Gathers specific events from event logs of several different machines to one central location.
- LockoutStatus.exe. Determines all the domain controllers that are involved in a lockout of a user in order to assist in gathering the logs. LockoutStatus.exe uses the NLParse.exe tool to parse Netlogon logs for specific Netlogon return status codes. It directs the output to a comma-separated value (.csv) file that you can sort further, if needed.
- NLParse.exe. Used to extract and display desired entries from the Netlogon log files.
Get your copy of the tools here.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine