Account lockout messages not in domain controller event logs

by Wayne Maples [Published on 20 April 2004 / Last Updated on 20 April 2004]

Prior to NT 4 SP4 message about the user account being locked out were only written to the security log of the workstations or servers where the events occurred and were not written into the security log of the domain controller where the error occurred. At that, the error message was only written if the audit policies were enable on the workstation. SP4 does what one would expect and writes these messages on the domain controller where the bad password limit was reached but ONLY if the audit policy for the domain enables Success for the User and Group Management audit category.

Event Log Tips:

Archiving Event Logs
Event Log explained
How to Delete Corrupt Event Viewer Log Files
Forensics: CrashOnAuditFail
Restrict access to Application and System event logs
Security Event Descriptions
Security Events Logon Type Definitions
Security Log Location
Suppress Browser Event Log Messages
Suppress Prevent logging of print jobs
System events in NT4 SP4
User Authentication with Windows NT
User Rights, Definition and List

Frank Heyne has made available a Windows NT Eventlog FAQ .

See Also

Featured Links