Audit Failure Codes

Archived from groups: microsoft.public.win2000.security (More info?)

Hello:
Is there a place I can find what the Account Logon Failure Codes and Event
Codes mean?

I have recently had a problem with Member Server that caused a large number
of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
account out but never generated the Account Lockout code I usually see when
an account reaches the Lockout threshold. Service Name: (mostly) Host/DC or
later Member Server. I did change password 3 days prior and do have mapped
drives, but had no difficultly logging onto Server.

Thanks,
1 answer Last reply
More about audit failure codes
  1. Archived from groups: microsoft.public.win2000.security (More info?)

    If you have not done such yet enable auditing of account management in
    Domain Controller Security policy and look in the security log of the pdc
    fsmo for account lockouts. The links below should be helpful including to
    tools and a white paper on account lockouts. --- Steve

    http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en
    http://tinyurl.com/68qbj -- same link, shorter.

    http://www.microsoft.com/technet/security/guidance/secmod144.mspx --
    Auditing and intrusion detection.

    http://www.microsoft.com/technet/support/ee/search.aspx?DisplayName=Windows%202000%20Server&ProdName=Windows%20Operating%20System&MajorMinor=5.0&LCID=1033
    http://tinyurl.com/6autp -- same link, shorter. Search for Event ID's.

    "Cindy" <Cindy@discussions.microsoft.com> wrote in message
    news:060130A1-DDF5-4217-93C2-D6E0FA675E47@microsoft.com...
    > Hello:
    > Is there a place I can find what the Account Logon Failure Codes and Event
    > Codes mean?
    >
    > I have recently had a problem with Member Server that caused a large
    > number
    > of Account Logon Failures on a DC. 2-4 every 5 seconds. It locked my
    > account out but never generated the Account Lockout code I usually see
    > when
    > an account reaches the Lockout threshold. Service Name: (mostly) Host/DC
    > or
    > later Member Server. I did change password 3 days prior and do have
    > mapped
    > drives, but had no difficultly logging onto Server.
    >
    > Thanks,
Ask a new question

Read More

Security Microsoft Servers Windows