How to find the source of a locked out account in Windows Server 2008 R2 / Windows 7

How to find the source of a locked out account in Windows Server 2008 R2 / Windows 7
Check in the DC, for event 4771 in the Security Log:

From the Client Address, you found the source of the problem.
Log into the client, check the event log/security log:



Here you can see a stored password is causing the problem. Delete the entry from the Stored Passwords app (Control Panel/User Accounts/Manage my network passwords).


Comments

  1. ComputerMan richard-artes.infoMay 18, 2016 at 3:15 AM

    You can also use the Microsoft Account Lockout and Management Tools (ALTools.exe). Thanks to James for pointing this out!

    ReplyDelete

Post a Comment

Popular posts from this blog

"The SNMP Service is ignoring the manager because its name could not be resolved." in Windows Server Event log.

 Interesting SNMP service problem on Windows. Since installing KB5051979 on Windows Server 2022 Standard, we can no longer use the SNMP service. The server no longer responds to SNMP requests from the management server <Server name>. Message in Event log on the problem server:- "The SNMP Service is ignoring the manager <Server name> because its name could not be resolved." The manager <Server name> CAN be pinged and resolved with DNS, also reverse lookup works. ............. Turns out, the GPO applying the policy for the names in the SNMP service had a fault. Re-created the GPO with the names again, and it worked.
Read more

Server Manager will not start, error .NET Framework: "This application requires one of the following versions of the .NET Framework:"

Server Manager will not start on Windows Server 2019 after installing ADConnect. Error ServerManager.exe: This application could not be started. .NET Framework: "This application requires one of the following versions of the .NET Framework:xxxxx Do you want to install .NET framework now?" Of course it's already installed automatically on the server, so if you try and install it again you can't, error "already installed". Try the .NET repair package, can't repair the install. Try dsim.exe to install the package, error "Microsoft .NET Framework is already part of this installation". .NET Runtime version : 4.0.30319.0 - This application could not be started.This application requires one of the following versions of the .NET Framework:  v4.0.30319 The answer is to re-create the registry entries deleted when you installed ADConnect:- [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319] "AspNetEnforceViewStateMac"=dw...
Read more