Centralizing Account Lockout events (Event ID 539) to only..

Archived from groups: microsoft.public.win2000.security (More info?)

Make sure that you have auditing of account management enabled in Domain
Controller Security Policy. You should see events 644 and 642 recorded on
the pdc fsmo domain controller when an account is locked out. I have not
verified that for Windows 2003 but it is worth checking. The link below
shows that event ID 644 still exists on W2003 for account management
auditing.

http://www.microsoft.com/technet/security/guidance/secm...

Otherwise you can use Event Comb to scan the security logs of multiple
computers for specific events and log them to a text file if that is
helpful. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyI...
-- Event Comb available here.


"CFB" <CFB@discussions.microsoft.com> wrote in message
news:E75E134C-C2E8-4AAA-A891-83452D27B03A@microsoft.com...
> I'm the NA for a bank and we use "Intrust for Events" to log and report
> our
> account lockouts (regulatory requirement). In the past, we've only polled
> our
> DC's for lockouts. We just migrated to 2003, and I've found the client now
> records the lockout and the DC doesn't seem to get a carbon copy of the
> lockout (539). In my reading, it appears 2003 treats lockouts differently
> and
> "offloads" the event recording to the client PC, whcih the client
> dutifully
> records, but not the DC.
>
> Does anyone know of a way to have all "domain" security events sent to one
> of the DC's? Even if the client could somehow CC the DC. It would be a
> real
> PITA to have to coordinate the capture of 200 client's security logs, and
> not
> to mention the cost of licensing for 197 PC's instead of 3 DC's.
>
> Any ideas would be greatly appreciated!!
>
> Thanks!!