Sign in with
Sign up | Sign in
Your question

Audit Failure Codes

Last response: in Windows 2000/NT
Share
Anonymous
a b 8 Security
November 18, 2004 8:11:01 PM

Archived from groups: microsoft.public.win2000.security (More info?)

Hello:
Is there a place I can find what the Account Logon Failure Codes and Event
Codes mean?

I have recently had a problem with Member Server that caused a large number
of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
account out but never generated the Account Lockout code I usually see when
an account reaches the Lockout threshold. Service Name: (mostly) Host/DC or
later Member Server. I did change password 3 days prior and do have mapped
drives, but had no difficultly logging onto Server.

Thanks,

More about : audit failure codes

Anonymous
a b 8 Security
November 19, 2004 4:43:05 AM

Archived from groups: microsoft.public.win2000.security (More info?)

If you have not done such yet enable auditing of account management in
Domain Controller Security policy and look in the security log of the pdc
fsmo for account lockouts. The links below should be helpful including to
tools and a white paper on account lockouts. --- Steve

http://www.microsoft.com/downloads/details.aspx?FamilyI...
http://tinyurl.com/68qbj -- same link, shorter.

http://www.microsoft.com/technet/security/guidance/secm... --
Auditing and intrusion detection.

http://www.microsoft.com/technet/support/ee/search.aspx...
http://tinyurl.com/6autp -- same link, shorter. Search for Event ID's.

"Cindy" <Cindy@discussions.microsoft.com> wrote in message
news:060130A1-DDF5-4217-93C2-D6E0FA675E47@microsoft.com...
> Hello:
> Is there a place I can find what the Account Logon Failure Codes and Event
> Codes mean?
>
> I have recently had a problem with Member Server that caused a large
> number
> of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
> account out but never generated the Account Lockout code I usually see
> when
> an account reaches the Lockout threshold. Service Name: (mostly) Host/DC
> or
> later Member Server. I did change password 3 days prior and do have
> mapped
> drives, but had no difficultly logging onto Server.
>
> Thanks,
!