Audit Failure Codes

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Hello:
Is there a place I can find what the Account Logon Failure Codes and Event
Codes mean?

I have recently had a problem with Member Server that caused a large number
of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
account out but never generated the Account Lockout code I usually see when
an account reaches the Lockout threshold. Service Name: (mostly) Host/DC or
later Member Server. I did change password 3 days prior and do have mapped
drives, but had no difficultly logging onto Server.

Thanks,

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

If you have not done such yet enable auditing of account management in
Domain Controller Security policy and look in the security log of the pdc
fsmo for account lockouts. The links below should be helpful including to
tools and a white paper on account lockouts. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
http://tinyurl.com/68qbj -- same link, shorter.

http://www.microsoft.com/technet/security/guidance/secmod144.mspx --
Auditing and intrusion detection.

http://www.microsoft.com/technet/support/ee/search.aspx?DisplayName=Windows%202000%20Server&ProdName=Windows%20Operating%20System&MajorMinor=5.0&LCID=1033
http://tinyurl.com/6autp -- same link, shorter. Search for Event ID's.

"Cindy" <Cindy@discussions.microsoft.com> wrote in message
news:060130A1-DDF5-4217-93C2-D6E0FA675E47@microsoft.com...
> Hello:
> Is there a place I can find what the Account Logon Failure Codes and Event
> Codes mean?
>
> I have recently had a problem with Member Server that caused a large
> number
> of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
> account out but never generated the Account Lockout code I usually see
> when
> an account reaches the Lockout threshold. Service Name: (mostly) Host/DC
> or
> later Member Server. I did change password 3 days prior and do have
> mapped
> drives, but had no difficultly logging onto Server.
>
> Thanks,