Network expert......please help!!

[GT20v]

recently,my login ID to domain always locked out..sometimes 10times a day.I suspect there is some culprit ie people that dont like admin that behind this.
I have no idea on how to check if any workstation except me that try to login using my password.

any solution or any tips or any idea at all?

Please help..really fedup liao...

heheh and dunt ask me to ask network admin aa......hehehhee

 

[ACM]

wat do u mean by lock?

 

[ACM]

izzit incorrect password?
Wat is the error message that prompt out?
how u solve it normally?

 

[differ]

you can't. you are only a client of the Windows Domain, you will need Domain Admin rights to track domain logins.

 

[psyk]

yeah the sifu has spoken..

go ask your network/windows admin for assistance.. :P

 

[GT20v]

well......im the network admin aiih still newbie..........and i dunno :)...mari...sifu..

anyway im using AD.......i know it can be done with audit logon event function....but i cant control this feature........any other way??

 

[GT20v]

dude ACM,

locked out meaning 3time wrong password.......what i confirm is.....i never chaneg or type anything........it just locked out like somebody use it and try to enter 3times...

anyway really sorry for the steering..hehhe

 

[differ]

but are you the Domain Administrator? you need to logon as Domain/Admin not just as local admin if you want to main domain stuff...

you suspect ppl login remotely or at your workstation?

 

[GT20v]

yes..i suspest it too......so now trying to find way to catch who..


im not the ultimate domain admin..but i can emmm can say domain operators lah with certain rights...so thats why i cant simply change the domain policy...aiih..

any idea, people??

 

[seperlinky]

You should try to dump all your PDC and BDC Security logs in your Event Viewer to see and check where is the login coming from. You might able to catch the culprit if he try to brute force.

Besides that, dont do a permanant map drive as everytime when somebody login to the PC, the mapped drive will try to use the credentials that you used to map (in this case coudl be yours) then it will try 3 times and it will lock our your id.

Hope this helps

 

[GT20v]

dude........err mine me asking..what is that PDC n BDC log??

hehehe sorry newbie here.......:)
and yeah about the mapping..now regret kaw2

 

[devil]

If i remember correctly, there is one virus which will burst the administrator Id by attempts to log and crack the passwod.

you might want to do a scan on all machines.

alternative, to prevent this problem ahppening again, rename your existing administrator to super_admin or something, then create a new user account call administrator and disable it, thats will resolve your account logout problem.

 

[seperlinky]

Dude,

PDC is your Primary Domain Controller and BDC is your Backup Domain Controller.

Do a seach on this, as it is lot of it you can read through the web.

Either or that, you need training ;))