Tracking down account lockouts

Tutorials Win: Microsoft Windows Forum

- Previous
  - 1
    - Migrating active directory and exchange I need to find the least painless way to migrate active directory with about 20,000 users and an Exchange server to a new set of servers at a new location. What's the best way to do this? I need to test the procedure before the actual move? Thank you! :) Tag: Tracking down account lockouts Tag: 176523
  - 2
    - Windows 2008 Authors Folks- I'm working on Windows 20008 Active Directory book, and I was wondering if anyone here is interested to participate in the project as contributor. Please consider that your name will be published as Contributor. All you have to do is to write four or five chapters in next 10 weeks. Please let me know if you are interested to proceed. This project has already been approved by the publisher. The TOC has been approved. I'll also provide you a sample chapter, authors kit and other tools to start working on this project. If you are interested then please send me your: 1. Resume 2. Prior Writing experience 3. Links to any published articles Thanks, Tariq: tariq.azad @ rogers.com Tag: Tracking down account lockouts Tag: 176521
  - 3
    - time to demote a dc on a site hello i have 2 dc on my first site (the main site) , and one who hold all the roles, i have a other site, where i have a other DC this site is connected to my main site with a global vpn 1Mo/s i already demote Dc but on the same site, so my two questions are 1) what is the exactly process of the demote operation (can i have a process paper) - does it contact the server who hold a special role ...etc ... 2) how many time could it take for the DC on my 2nd site to be demote, or how can i calculate it because i have user who are connected to my main site with TSE, and they must be connected all the time between 8H to 12H and 13 to 17 H thanks nt Tag: Tracking down account lockouts Tag: 176513
  - 4
    - Active problem To all, Having some interesting things happening on a 2000 dc. 1. system state backup fails with "active directory reported an error" that is with Ntbackup. The tivoli client reports a problem on sys state at ntds. 2. An online defrag has not run successfully since 2/8 on 2/8 the following events were reported in the log Event Type: Error Event Source: NTDS ISAM Event Category: Logging/Recovery Event ID: 203 Date: 2/8/2008 Time: 1:00:59 AM User: N/A Computer: SAMPGHSBL021 Description: NTDS (352) The database engine has stopped the backup with error -1022. Event Type: Error Event Source: NTDS ISAM Event Category: Performance Event ID: 0 Date: 2/8/2008 Time: 1:00:59 AM User: N/A Computer: SAMPGHSBL021 Description: NTDS (352) Unexpected Win32 error: 0x20 Event Type: Error Event Source: NTDS ISAM Event Category: Performance Event ID: 0 Date: 2/8/2008 Time: 1:00:59 AM User: N/A Computer: SAMPGHSBL021 Description: NTDS (352) Unexpected Win32 error: 0x3E6 Besides the backup and online defrag I cannot seem to find any other issue. AD is working, from all appearances and there are no other log entries showing for what I would expect is a corrupt AD. Any ideas on this would be very helpful Tag: Tracking down account lockouts Tag: 176512
  - 5
    - Account lock out frequently A domain user account always lock out almost everyday! Other domain user accounts do have this problem. What could be the possible cause of it? Tag: Tracking down account lockouts Tag: 176508
  - 6
    - FYI: Information about using Last Logon Information in Windows Server 2008 and Windows Vista This is a multi-part message in MIME format. ------=_NextPart_000_003F_01C86C45.4EAC5840 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable http://blogs.dirteam.com/blogs/jorge/archive/2008/02/11/showing-last-logo= n-info-at-logon-in-windows-server-2008.aspx Enjoy! --=20 Cheers,=20 (HOPEFULLY THIS INFORMATION HELPS YOU!) # Jorge de Almeida Pinto # MVP Windows Server - Directory Services BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx -------------------------------------------------------------------------= ----------------- * How to ask a question --> http://support.microsoft.com/?id=3D555375 -------------------------------------------------------------------------= ----------------- * This posting is provided "AS IS" with no warranties and confers no = rights!=20 * Always test before implementing! -------------------------------------------------------------------------= ----------------- ################################################# ################################################# -------------------------------------------------------------------------= ----------------- ------=_NextPart_000_003F_01C86C45.4EAC5840 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Diso-8859-1"> <META content=3D"MSHTML 6.00.6001.17128" name=3DGENERATOR> <STYLE></STYLE> </HEAD> <BODY bgColor=3D#ffffff> <DIV><FONT face=3DVerdana size=3D2><A=20 href=3D"http://blogs.dirteam.com/blogs/jorge/archive/2008/02/11/showing-l= ast-logon-info-at-logon-in-windows-server-2008.aspx">http://blogs.dirteam= .com/blogs/jorge/archive/2008/02/11/showing-last-logon-info-at-logon-in-w= indows-server-2008.aspx</A></FONT></DIV> <DIV><FONT face=3DVerdana size=3D2></FONT> </DIV> <DIV><FONT face=3DVerdana size=3D2>Enjoy!</FONT></DIV><FONT = face=3DVerdana size=3D2> <DIV><BR>-- <BR><BR>Cheers, <BR>(HOPEFULLY THIS INFORMATION HELPS = YOU!)</DIV> <DIV> </DIV> <DIV># Jorge de Almeida Pinto # MVP Windows Server - Directory = Services</DIV> <DIV> </DIV> <DIV>BLOG (WEB-BASED)--> <A=20 href=3D"http://blogs.dirteam.com/blogs/jorge/default.aspx">http://blogs.d= irteam.com/blogs/jorge/default.aspx</A><BR>BLOG=20 (RSS-FEEDS)--> <A=20 href=3D"http://blogs.dirteam.com/blogs/jorge/rss.aspx">http://blogs.dirte= am.com/blogs/jorge/rss.aspx</A><BR>--------------------------------------= ----------------------------------------------------<BR>*=20 How to ask a question --> <A=20 href=3D"http://support.microsoft.com/?id=3D555375">http://support.microso= ft.com/?id=3D555375</A><BR>----------------------------------------------= --------------------------------------------<BR>*=20 This posting is provided "AS IS" with no warranties and confers no = rights! <BR>*=20 Always test before=20 implementing!<BR>--------------------------------------------------------= ----------------------------------<BR>###################################= ##############<BR>#################################################<BR>--= -------------------------------------------------------------------------= ---------------</FONT></DIV></BODY></HTML> ------=_NextPart_000_003F_01C86C45.4EAC5840-- Tag: Tracking down account lockouts Tag: 176505
  - 7
    - AD Query Over time I have saved several queries to the AD users and computers, saved queries container. They all worked fine until we implemented Novell identity manager to syncronize users across directories. Since then, the queries which return servers or workstations has worked fine. However queries which return users or groups now return nothing. Anyone have any ideas as to a permission or attribute change which would cause this? Thanks... Tag: Tracking down account lockouts Tag: 176501
  - 8
    - Replace Volume that AD is on I have a 2003 SP 1 DC with all the FSMO Roles on it. I need to replace a volume on this server that hosts the AD folders. If I do a backup to tape, then replace the volume and then do a restore, will replication be okay or will I need to do anything special? Thanks, Jim Tag: Tracking down account lockouts Tag: 176488
  - 9
    - DCPROMO Virtual Server I am trying to get a Virtual test network setup with a copy of our active directory. What would be the best way to do this? I was thinking I could create a Virtual Server on our live network, run DCPROMO on it to promote it to a DC, make a copy of the virtual server image file (to be used for testing), then run DCPROMO again on it to demote it. I would then take the copy of the virtual server image and set it up on the test network. Does this sound like a ok/safe way of doing this? Tag: Tracking down account lockouts Tag: 176486
  - 10
    - LDAP Query I want to make a LDAP Query in Windows 2000 based Active Directory to get a list of people who logs to a certain workstation an dthe total number. How do i do this? -- Ansy Tag: Tracking down account lockouts Tag: 176480
  - 11
    - Exchange 2003 installation In Windows 2000 active directory Exchange 5.5 was running fine. Now Exchange5.5 made offline and not available now. When I try to install Exchange 2003 in this Active directory it is now allowing me to install. Can anybody throw light on this issue? Best Regards, Sathya Tag: Tracking down account lockouts Tag: 176478
  - 12
    - Domain member I have an AD account solely for the purpose of joining workstations as a domain member. What are the rights to be granted to this account? Tag: Tracking down account lockouts Tag: 176475
  - 13
    - Trusted domains Hello! Can i make a trusted domains without merging tree when the 1st domain is main.domain.com and the 2nd domain is test.main.domain.com? I.e. can exists main.domain.com and test.main.domain.com like a different domains but with trusts between? P.S. I'm not trust admins from the main domain and didn't want give them whole rights on my test.main.domain.com. Thanks! Tag: Tracking down account lockouts Tag: 176473
  - 14
    - Missing schema attributes in ADSIEdit I am trying to update my Windows 2000 Server domain (with Exchange 2000) to Windows Server 2003. To do so, I must apply the inetorgpersonfix.ldf file before upgrading to avoid mangling some AD attributes that were created when we installed Exchange 2000 years ago. See: http://support.microsoft.com/default.aspx?scid=kb;en-us;314649 The problem I'm having is that the fix won't run because it says the AD directory object it's trying to upodate is not found. Upon looking into the issue using ADSIEdit, it looks like I'm missing entries related to my schema. Under ADSI Edit I have no Schema or Configuration entries for my domain, just the Domain entry, and it's not showing up on the other domain controller either. This example pic shows what I'm missing: http://www.petri.co.il/forums/attachment.php?attachmentid=129&d=1121999118 I only have the Domain section. Any idea how to fix this? I saw a "Reload Schema" option but I'm hesitant to use it before I know exactly what it does. Thanks. Tag: Tracking down account lockouts Tag: 176470
  - 15
    - Re: RADIUS WiFi Security, Folder Re-Direction, Sync., Offline Folders? I inherited a SOHO setup with a W2K Server Small Business, a W2K3 Server, and a handful of PC's (WinXP Pro, SP2). I installed a new WiFi router (Linksys w/VPN, RADIUS, etc. support), and a new switch (Linksys). I setup this router as the gateway and DNS1. I also re-installed the O/S's on the 2 servers and setup the W2K3 Server as the DC and DNS2. The new domain name is different than before (now, web/email hosting is off site). On the W2K3 Server, I started to re-create user names and logins in Active Directory. The PC's are still looking for the "old" servers for "My Documents" synchronization, anti-virus updates, etc. How do I fix the synchronization issue (new A-V software is going to be installed)? Also, how do I setup Active Directory to do RADIUS for the WiFi router, and what settings must I copy to the router (I can change the encryption and authentication in the router, but both router and DC have to agree)? One last thing... How do I setup standard user account settings (everything from wallpaper to permissions)? Thanks a bunch! F3 <>< Tag: Tracking down account lockouts Tag: 176465
  - 16
    - Re: RADIUS WiFi Security, Folder Re-Direction, Sync., Offline Folders? I inherited a SOHO setup with a W2K Server Small Business, a W2K3 Server, and a handful of PC's. I installed a new WiFi router (Linksys w/VPN, RADIUS, etc. support), and a new switch (Linksys). I setup this router as the gateway and DNS1. I also re-installed the O/S's on the 2 servers and setup the W2K3 Server as the DC and DNS2. The new domain name is different than before (now, web/email hosting is off site). On the W2K3 Server, I started to re-create user names and logins in Active Directory. The PC's are still looking for the "old" servers for "My Documents" synchronization, anti-virus updates, etc. How do I fix the synchronization issue (new A-V software is going to be installed)? Also, how do I setup Active Directory to do RADIUS for the WiFi router, and what settings must I copy to the router (I can change the encryption and authentication in the router, but both router and DC have to agree)? Thanks a bunch! F3 <>< Tag: Tracking down account lockouts Tag: 176464
  - 17
    - Possible to trust domains in separate forests in 2000? We have 2 domains - each one in it's own forest. Is it possible with Windows 2000 to create a trust between them, or is this only allowed in 2003? We are looking to combine our 2 domains and are just now going through the long list of avoidable pitfalls. thank you in advance. Tag: Tracking down account lockouts Tag: 176458
  - 18
    - Logon Script registry check how to? We have a custom key set in the registry of our XP client machines to differentiate our image build versions. We would like to be able to check that this key (or variants of, depending on build number) exists when a users logs on to the domain (to be sure they are using current builds or even actual internal images). Can this be done via a simple logon script where it would check the presence for one of the defined variable in the client registry (ie: "\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\S ession Manager\Environment")? If the variable is not present it would be logged to a .txt file. I imagine this wouldn't be too difficult but my scripting skills are simply not up to the job...appreciate any feedback. Tag: Tracking down account lockouts Tag: 176456
  - 19
    - crashed DC1 server Hi, Murphy rules again. An old Windows 2003 server was the first DC in the AD. It was schema master, etc. The new server arrived this week but... the old one quit yesterday with a repeated STOP 0x0000007B error. I cannot get it back up, I cannot even access the disks using a tool like BartPE. There is a Windows 2003 DC2 server in the same domain that I want to give all FSMO's. Doing that it rather straight forward as far as I know, but... I still need to delete the crashed DC1 from the domain. Which KB describes all the steps? I cannot find it? Bonno Bloksma Tag: Tracking down account lockouts Tag: 176454
  - 20
    - Domain Administrator Lockout Hi, I see in system even log SAM database error messages saying that Account Can't be locked, due to resource error Event ID:12294, and that account is domain\administrator That means something or someone is trying to logon to domain as administrator but failing. (also can't lock the account, because I disabled). How I find from what IP or workstation these attempt being made? Event log doesn't mention Thanks MC Tag: Tracking down account lockouts Tag: 176451
  - 21
    - Group nesting troubles Hi folks, I'm having a bit a problem with some group nesting issues and I hope some of you might be able to point out the errors of me ways. Please see the problem below: A user cannot access a folder on a file server. This folder has NTFS modify access permission set for "Group C". The user is a member of "Group A" which is nested in "Group B" which is in turn nested in "Group C". Folder Resource -> Group C -> Group B -> Group A -> User Native mode 2003 domain Group A (Universal Distribution) Group B (Universal Security Group) Group C (Universal Security Group) If the user is added directly to the folder resource he can access the folder so I am wondering if this a nesting issue (access token limitation) or an issue with Security/Distribution? Very much appreciate any help or pointers. Thank you. Tag: Tracking down account lockouts Tag: 176449
  - 22
    - retiring the 1st DC in the domain I am running a 2000 domain, all servers run Win2k /SP4. I would like to retire the 1st domain server and use the server at a small remote site which is not part of the domain. As I write this, this machine currently runs all 5 FSMO roles. My qustion is, how shoudl I transfer these? Are there any problems even if the transfer is succesful? Any suggestion in general? Regards, Tag: Tracking down account lockouts Tag: 176445
  - 23
    - domain users can not change printer page layout hi, i am using widows 2003 server as domain controller i want that the users should not change the page layout of the printer when they send a page for printing. i want that all the users should print the page only in A4 type. i want to restrict users to print only A4 page format print. can any body help me. thanks. Tag: Tracking down account lockouts Tag: 176440
  - 24
    - Using old machine to upgrade from NT to 2k then move FSMOs all to I have to upgrade the network at my school. I have been having problems with tests of CDs to upgrade with my HP Poliant servers. I am wondering if i can use one of my workstations (at least 1.8GHz CPUs) to install NT on as a BDC then upgrade to PDC...then upgrade to 2k. I know this isn't great since the machine is older. Could I do this just to upgrade the database to A.D. then run DCPROMO on my 2k member servers and then transfer all the FSMO roles off the old workstation. Thanks for any advise. Tag: Tracking down account lockouts Tag: 176438
  - 25
    - naming information cannot be located because Hello to all Pro Naming Information cannot be located because: the specified domain either does not exist or could not be contacted. Scenario: Problem with Windows 2000 Advanced Server failed to boot up, then force it to boot i use F8 then goto Last good known configuration and it boot up. But the Problem is when I click on "Active Directory Users and Computers" it displays "Naming Information cannot be..." error but when i click on "Connect to Domain Controller..." and put the server.domain_name.local it can connect to domain. Another problem occur when i want to share my folder for example then add permission to it will display the "Object Picker cannot open because no locations from which objects could be found." therefore i cannot open the Active Directory Users. Pls. help God bless Tag: Tracking down account lockouts Tag: 176436
- Next
  - 1
    - Deleted Accounts(E-mail Exchange) HELP!!! We are currently sitting in a Mixed Mode Environment. Between a WinNT Domain and Win2K Active Directory. We have Multiple WinNT Domain. In Active Directory Management, under Users I noticed there was alot of User Accounts that all had a -1 after them. So I highlighted all these accounts and deleted them. When I did this, it apparently wiped out all the e-mail accounts on the other NT Domains out there. Somehow, these accounts with the -1 were associated to e-mail accounts on the other NT Domains. Can anyone explain why? And since this account is deleted, it looks like the e-mail account is deleted as well. Is the e-mail account gone as well, or is there a way to restore it?? Any help would be appreicated. Tag: Tracking down account lockouts Tag: 176424
  - 2
    - testing authoritative restore of objects in a windows 2003 SP2 domain Hi guys, I need to test the authoritative restore of a couple of objects in a 2k3 SP2 domain. I have two questions: If I have 3 servers: server1: All FSMO roles (GC too) server2: GC server3: GC Is it ok to perform the authoritative restore on server1 ? Is it ok to just shutdown the other two domain controllers while doing the restore procedure and turn them on once the restore is completed ? Will they automatically replicate with the primary domain controller and get the new (or old,,,depending on how you see it ;-)) objects according to standard AD replications ? Also, does the restore procedure restores exchange attributes, in the event the restore also includes a mailbox enabled user ? Thank you so much in advance for your answer. Have a nice day, zz Tag: Tracking down account lockouts Tag: 176414
  - 3
    - Unable to login from Pre Windows 2000 PCs I have a Domain for which I have created one additional DC. I still have some win9x PCs which login to this domain for resource utilization. All of a sudden they started to get "The username Or Passwword you have typed is incorrect or logon to domain is denied" error. Where as I tried login with the same user and password from WinXPP pcs there they were successfull. I installed ADSClient also but for no avail. ADC is running web services also. Then I tried restarting the ADC then only the Win9x PC were able to login. Can anybody throw some light on why this happened. Cheers, Sudhi... Tag: Tracking down account lockouts Tag: 176410
  - 4
    - Remote Reboot Registry Keys I am looking for the Rebote Reboot Registry keys but am having no luck in locating them. I need these because I have added Guest and Interactive to the users list and need to copy this to all my other stations remotely. Any one with a suggestion is greatly appreciated. Thanks James Tag: Tracking down account lockouts Tag: 176409
  - 5
    - problem in xp One day i insert a chip(monthly) cd and i got some alerts through kaspersky anti virus that some exe files are executing then i quarantine .. From that time onwords my account hass been logged off and asking for password eventhough i dont have password,.. i entered ok with out any password then logged in and logged off... even if i got this problem with adminstrtor as user name .. anybody helpme please!!!! Tag: Tracking down account lockouts Tag: 176408
  - 6
    - login Scripts not running I have an OU that caintain another OU beneath it. The aprent OU is called WSUS and the lowere OU is called W2K. W2K contains all W2K workstations and WSUS contains the WinXP workstations. I have an GPO on each. WSUS contains the settings for Windows update as well as a login script to enable automatic updates and start the service becuase the services are stoped and disabled. W2K runs a login script to correct DSRT issues. Both login scripts are computer policies. The strange thing is everythingr uns fine on the XP cleints. For the W2K clients who are not at the main site where the script is located in the netlogon directory on the main DC it appears the script is not running. Shouldn't the GPO flow down to the W2K direcotry. Is there any reason why the script to start automatic updates wouldn't apply to cleints at a different site. Any help would be most appreciated. Tag: Tracking down account lockouts Tag: 176389
  - 7
    - Configure NTP server/clients with no internet connections All, I have a newtwork with several w2k servers and winXp clients. I have no internet connection. I have recently been having time issues on my network. Time is not syncn'ing up with my NTP time server anymore.. And i think i messed it up.. I want to have ServerA host my NTP time source using the CMOS battery on the server, and all the XP clients point to ServerA for their NTP time provider. How do i configure this properly? Is there a GOOD KB article on how to setup disconnected (no internet) networks with a proper NTP time source? TIA Drum on .. .. . . . Tag: Tracking down account lockouts Tag: 176388
  - 8
    - Set UNIX Attributes by Command line Hello there'a way or a script (by command line) to set UNIX Attributes (nis Domain, uid, ecc.) in active dictory? Tanks to all Tag: Tracking down account lockouts Tag: 176387
  - 9
    - AD User & Inherited Permissions I have a Domain Admin User object that is behaving strangely. It is located in the root of the domain object. When I go into the security tab and then select the advanced button, I notice the the inherited permission check box is not selected. So I selected it and clicked Apply and OK. A Couple hours latter the box is unchecked. I then manually checked the box on all of our DC's within about 2 minutes time. Within an hour or two the box was unchecked again. I need this Domain Admin to receive the Inherited permissions. Where do I go from here? Jim Tag: Tracking down account lockouts Tag: 176382
  - 10
    - Rename Domain Controller DC Hi Pros, I been trying to rename the current DC, from WORLDGROUPC to WORLDGROUPC by using Netdom. WORLDGROUP is the old DC with Windows NT 4.0 and WORLDGROUPC is Windows server 2003 we are going to replace the Old server to the new one, therefore, we need to change the NEW server(WORLDGROUPC) to the name of the OLD server(WORLDGROUP). the thing is, I have disconnected the NEW DC from the network when i tried rename it, so that it won't crashes with the OLD DC (which is still running) in the network. so, now the DC (WORLDGROUPC) is standalone, doesn't connect to any network, and i want to change the DC name to WORLDGROUP but in the command Prompt: >netdom computername WORLDGROUPC /add WORLDGROUP When i enter this, it prompt up error: RPC Server is unavailable. please help me to solve this problem, thanks in advance -- Message posted via WinServerKB.com http://www.winserverkb.com/Uwe/Forums.aspx/windows-2000-active-directory/200801/1 Tag: Tracking down account lockouts Tag: 176380
  - 11
    - Active directory replication schedule Hello, can someone explane to me what the differents are between replication schedules? I mean when i open sites and services I see one schedule on the NTDS settings of the site (NTDS site setting), drill down on that site i see a schedule on the replication partner server settings, and I can see a schedule on the site links. I cant exacly tell what the different is can anybody tell me? Thanks, Eric Tag: Tracking down account lockouts Tag: 176369
  - 12
    - Grant ntfs permission on domain computer to WORKGROUPComp\User How can I grant ntfs permission on domain computer to WORKGROUPComp \User? 1. Computer CompA is a member of Domain DomA 2. Computer CompB is standalone workgroup machine 3. There is TCP/IP connection, routing and DNS resolution between CompA and CompB 4. I need to grant the CompA\SomeUser the permission on some folder of CompB What is the correct method to perform this? Thanks in advance, Dmitry Tag: Tracking down account lockouts Tag: 176368
  - 13
    - Practice Test Search Engine, It will be your best web site | http://exams.googletoad.com http://exams.googletoad.com Just write your exam number or general phrase (70-227,642-642,cisco,oracle,microsoft,hp,juniper etc.) and hit the search button. Choose your dump (actualtests,pass4sure) , click detail page and click download button. If you have any request just fill the form on the site.. Enjoy.. Tag: Tracking down account lockouts Tag: 176367
  - 14
    - IWAM and IUSR Accounts I'm fairly clueless as to why these accounts are needed. I see the explanation in the account properties, but my question is, does every server in the domain need to have one of these user accounts? Tag: Tracking down account lockouts Tag: 176364
  - 15
    - Delegatoin w/ Protocol transition in a Windows 2000 native domain Hi, Some background information first. I have a root domain "rootdom.com" and two child domains "c1.rootdom.com" and "c2.rootdom.com". In the c1 domain I have an IIS 6 with an ASP.net application on it that's running forms-based authentication as well as an Exchange 2003 frontend server running integrated authentication (integrated authentication is the only box checked). The ASP.NET application needs delegated access to the exchange frontend-server by means impersonating the user who's logged in with forms authentication and querying webdav with the user's credentials. What I've done so far: 1. Created a domain user in the "rootdom.com"-domain called "DelegationUser". This account is trusted for delegation. I don't have the "Delegation" tab you get in a 2003-native domain since I'm running 2000-native on all domains. 2. Created service principal names for the "DelegationUser" user the service principal names are: "aspnetserver" and "aspnetserver.c1.rootdom.com" 3. Assigned "DelegationUser" to the ApplicationPool that's running the ASP.NET application which included adding delegationuser to the IIS_WPG group and granting the user the "Act as part of the operating system" privelege on the ASP.NET server. 4. Turned off impersonation on the ASP.NET application 5. Used programmatic impersonation in the ASP.NET application where I create a "new WindowsIdentity(UPN_OF_USER_I_WANT_TO_IMPERSONATE).Impersonate()" 6. While impersonating I query the Exchange 2003-frontend server with webdav. 7. End impersonation and revert to the application pool user which runs the ASP.NEt application Step 6 fails with a 401-error code while steps 1-5 seem to work just fine. I've even checked the identity of the current thread while impersonating, and I can see that it is in fact the user that I'm impersonating. However, the identity is not being delegated to the exchange 2003 server. Things I've tried my self: 1. Trusting the computer accounts for the ASP.NET server and the Exchange 2003 frontend server for delegation. However, this didn't make any difference. 2. Looking in the IIS log "C:\Windows\System32\LogFiles" on the Exchange 2003 server. Doing this I can see that the IIS is reading my webdav queries as anonymous requests. This leads me to believe that it's reverting to NTLM which isn't delegatable. 3. Looking in the event log of the c1.rootdom.com DC and I've seen no failure audits. I presume that this is the DC that should be issuing tickets for the aspnetserver? I know the above scenario works with constrained delegation, since I've done it in a 2003-native domain set up. But it SHOULD work in a 2000-native domain as well. Any help? Tag: Tracking down account lockouts Tag: 176359
  - 16
    - DC Demotion Checklist? Greetings, I know there are a ton of checklist for promoting a server to a domain controller, but how about in the other direction? We are carrying out a hardware replacement and need to demote the DC's that are being retired. Are there steps I need to take care of or people I need to notify prior to doing so? Are there any steps I should take other than just running DCpromo and being done with it? Any suggestions appreciated. Tag: Tracking down account lockouts Tag: 176354
  - 17
    - What Is A Domain Name And Where To Register? A domain name is an alias for an IP address. Now what is an IP address? An IP address is a numeric code that signifies where to look through the Internet for content. An example of an IP address would be 22.226.141.25. Rather than typing in a long and easily forgotten IP address, a domain name helps you by typing an easily remembered name to access the same site. For example, www.domainsatretail.com is a domain name that points to a specific IP address. People can remember a domain name such as www.domainsatretail.com much easier than they can a long numeric code. Domain names are everywhere as many use it everyday. Think of search sites. Google and Yahoo both have corresponding domain names www.google.com and www.yahoo.com. If you have ever sent an email you have used a domain name. For example when http://www.dontplayplay.com/html/Internet/20060929/31898.html Tag: Tracking down account lockouts Tag: 176352
  - 18
    - What Is A Domain Name And Where To Register? A domain name is an alias for an IP address. Now what is an IP address? An IP address is a numeric code that signifies where to look through the Internet for content. An example of an IP address would be 22.226.141.25. Rather than typing in a long and easily forgotten IP address, a domain name helps you by typing an easily remembered name to access the same site. For example, www.domainsatretail.com is a domain name that points to a specific IP address. People can remember a domain name such as www.domainsatretail.com much easier than they can a long numeric code. Domain names are everywhere as many use it everyday. Think of search sites. Google and Yahoo both have corresponding domain names www.google.com and www.yahoo.com. If you have ever sent an email you have used a domain name. For example when http://www.dontplayplay.com/html/Internet/20060929/31898.html Tag: Tracking down account lockouts Tag: 176351
  - 19
    - Disable network bridge by GPO Hi, My company has a Windows 2000 network with XP and 2000 workstations. We are trying to disable Network Bridge by using GPO, so we took an XP system template and add it to the Administrative templates on a Windows 2000 DC and enabled "Prohibit installation and configuration of Network Bridge on your DNS domain network" from "Local Computer Policy, Computer Configuration, Administrative Templates, Network, and Network Connections." It works if there is no network bridge on the XP workstation, but if there is already a bridge setup, the GPO cannot be applied to it. Any suggestions? Thanks. William Tag: Tracking down account lockouts Tag: 176349
  - 20
    - kostenloser werbefreier webspace mit domain kostenloser werbefreier webspace mit domain http://www.xd03.com/webspace/ http://www.xd03.com/webspace/ http://www.xd03.com/webspace/ http://www.xd03.com/webspace/ kostenloser werbefreier webspace mit domain frei webspace werbefrei mit domain host webspace werbefrei mit domain bilder webspace werbefrei mit domain kostenlos webspace werbefrei mit domain php 2gb webspace werbefrei mit domain webspace werbefrei mit domain test kostenlose webspace werbefrei mit domain homepage webspace werbefrei mit domain webspace werbefrei mit domain mieten kostenlosen webspace werbefrei mit domain kostenlos webspace werbefrei mit domain webspace werbefrei mit domain angebot domain und webspace werbefrei mit domain domain webspace werbefrei mit domain shop webspace werbefrei mit domain funpic webspace werbefrei mit domain kostenlos werbefrei webspace werbefrei mit domain webspace werbefrei mit domain frontpage bilder webspace werbefrei mit domain webspace werbefrei mit domain guenstig webspace werbefrei mit domain schweiz unlimited webspace werbefrei mit domain webspace werbefrei mit domain vergleich 100 mb webspace werbefrei mit domain gratis webspace werbefrei mit domain mit php webhosting webspace werbefrei mit domain kostenfrei webspace werbefrei mit domain typo3 webspace werbefrei mit domain ftp webspace werbefrei mit domain kostenlos reseller webspace werbefrei mit domain kostenlos php webspace werbefrei mit domain freier webspace werbefrei mit domain webspace werbefrei mit domain anbieter php webspace werbefrei mit domain gratis domains webspace werbefrei mit domain web hosting unlimited domains gmx webspace werbefrei mit domain webspace werbefrei mit domain angebote 100mb webspace werbefrei mit domain domain mit webspace werbefrei mit domain webspace werbefrei mit domain kostenfreier webspace werbefrei mit domain confixx webspace werbefrei mit domain gratis webspace werbefrei mit domain ftp cgi webspace werbefrei mit domain werbefreier webspace werbefrei mit domain billig webspace werbefrei mit domain asp webspace werbefrei mit domain webspace werbefrei mit domain hosting provider webspace werbefrei mit domain domain webspace werbefrei mit domain kostenlos kostenloser webspace werbefrei mit domain webspace werbefrei mit domain werbefrei cheap webspace werbefrei mit domain blog webspace werbefrei mit domain gratis webspace werbefrei mit domain webspace werbefrei mit de domain webspace werbefrei mit com domain webspace werbefrei mit net domain webspace werbefrei mit org domain webspace werbefrei mit info domain webspace werbefrei mit biz domain webspace werbefrei mit gr domain webspace werbefrei mit ag domain webspace werbefrei mit nl domain webspace werbefrei mit us domain webspace werbefrei mit la domain webspace werbefrei mit eu domain webspace werbefrei mit be domain webspace werbefrei mit at domain webspace werbefrei mit ch domain webspace werbefrei mit mx domain webspace werbefrei mit br domain webspace werbefrei mit pl domain webspace werbefrei mit ru domain webspace werbefrei mit jp domain webspace werbefrei mit mobi domain webspace werbefrei mit pr domain de domains guenstig bestellen und registrieren com domains guenstig bestellen und registrieren net domains guenstig bestellen und registrieren org domains guenstig bestellen und registrieren info domains guenstig bestellen und registrieren biz domains guenstig bestellen und registrieren gr domains guenstig bestellen und registrieren ag domains guenstig bestellen und registrieren nl domains guenstig bestellen und registrieren us domains guenstig bestellen und registrieren la domains guenstig bestellen und registrieren eu domains guenstig bestellen und registrieren be domains guenstig bestellen und registrieren at domains guenstig bestellen und registrieren ch domains guenstig bestellen und registrieren mx domains guenstig bestellen und registrieren br domains guenstig bestellen und registrieren pl domains guenstig bestellen und registrieren ru domains guenstig bestellen und registrieren pr domains guenstig bestellen und registrieren mobi domains guenstig bestellen und registrieren reseller domains bestellen order and register greek domains cheap web hosting and domain provider cheap san francisco web hosting and domain service web hosting and domain reseller cheap hosting and domainservice cheap web hosting and domain reseller service webhosting and domain reseller service cheap hosting and domain service hosting web hosting domain internet domain service cheap transfer domains dns hosting dns domain dedicated hosting with cheap domain internet webhosting with cheap domain domains host webhosting free web hosting offer domain offer hosting agreements domain agreements php web hosting with cheap domain hosted domains webhosting domain cheap web host domain register cheap globat hosting domain register resell domains webspace reseller affordable web hosting web hosting providers domain providers register domains order webspace high quality web hosting and domain service traffic flat domain register webhosting web hosting domain service register cheap domains php hosting domain service php register cheap domains asp hosting domain service asp register cheap domains webhosting webdesign domain service cheap buy cheap domains webhosting email provider domain provider webhosting provider webspace server hosting server housing domain register ftp webhosting ftp webspace domain service register cheap internet domains dna domain internet webspace buy cheap domain hosting cheap webspace hosting buy cheap domains order cheap webspace with domain fast web hosting cheap domains for sale domains for sale cheap webhosting with cheap domain linux domain hosting linux webhosting free web hosting domain service register cheap domains Tag: Tracking down account lockouts Tag: 176346
  - 21
    - Best Free People Search I came across this site that looks pretty amazing. You can conduct your own people searches and best of all it's free to sign up. http://www.bestfreepeoplesearches.info Tag: Tracking down account lockouts Tag: 176345
  - 22
    - Prevent some Domain Admin Account from creating USERS, Groups, OUs How Can I PREVENT some specific Domain Admin Accounts from creating User Account, Security Groups, OUs and modifying those object properties?? These Domain Admin Account handle administrative tasks over Domain Controllers Servers such as: Install/Uninstall Software, Add Server Roles, Promote New Domain Controller, Configure AD Replication, DNS Configuration, DHCP Configuration, Manage Event Viewer, TroubleShooting related Tasks, Restart Services,etc... As far as I know the only way they can do all those things in a domain Controller Server is making those Users Account Domain Admins.... Im almost sure that the "Delegate Control" Concept doesnt work in this case, please correct me if Im wrong.... I Tried Restrict loading of Active Directory Users & Computers snap- in into MMC.... but the users already know how to manage Users or Groups using Command - Line Tools or Scripts.... I Tried removing those Account from Domain Admins Group.... I created a group where I place all of those user accounts, then I placed these group as member of other Built In Security Group Such as: DHCP Administrators, DNS Administrators, Server Operators, Network Configuration Operators, etc.... I Also gave most of the Privileges that Domain Admin Group Has... and yes.. I prevented these users from managing Users, Groups or OUs.. but that also I prevented these users from Installing/Uninstalling software, Restarting Services, Adding Roles, they couldnt handle AD Replication, etc.... So at the end it didnt work the way I wanted.... And finally I tried to place these accounts in two Security Groups: Domain Admins and a group called "LEVEL1". Using ADUC Permissions TAB, I configure "LEVEL1" group with DENY permisiions over USER, GROUP an OUs Objects... hoping that "the most restrictive permission would apply"... but sadly... it didnt work neither.... So I really hope you can guide how to achieve this goal. Tag: Tracking down account lockouts Tag: 176343
  - 23
    - M.I 5-Perse cution . my re sponse to the harassme nt -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- -=. my response to the harassment -= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- My first reaction in 1990/91 was to assume that if I. broke contact then they would not be able to follow. and would lose interest. So I did the things that have been suggested. by other people; I sold my television, stopped. listening to the radio and tried to withdraw away from the sources of abuse as much as possible. I. reasoned that they must have more important things to deal with and that normal people. would simply leave me alone if it were made. difficult for them to continue their harassment. I reckoned without the sheer. vindictiveness of the abusers. They did not let up but instead "got to" people around me, mainly. people at work, to do their dirty work for them. I went to see my. GP, who refused to believe what he was being told, and. refused to direct me on to anyone who could be of practical assistance. It was not until three years had. passed that the GP admitted the matter was outside his competence and. suggested going to the police. In the summer of. 1994 we called in counter-surveillance experts from a private detective. agency to sweep our house and telephone for bugging devices. They conducted a thorough search and found nothing; but. as noted above, since the existence of surveillance was being forced in. my face by the harassers, you. would expect them to have taken the possibility of a counter-surveillance sweep into account when planning the type. of devices to. be employed. In Easter. 1995 I made a complaint to my local Police station in London, but the police have not expressed any intention to do. anything about the continuing harassment ("we're not saying. it's happening and we're not saying. it isn't happening" were the words used). I think the officer I spoke to at Easter wasn't aware of it happening, although. other members of the police force obviously. do know. From April 1995 until the present time the matter has. been discussed in a lot of detail on the. Usenet (Internet) "uk.misc" newsgroup. That discussion has given birth to the article which. you are now reading. My hopes in posting to Usenet. were that wider publicizing would discourage the security services from continuing their harassment, and "draw. people out" into concurring with the truth of. what was being said. Neither of those have followed, but the discussion has served a purpose in allowing. this structured report to. be created. 9037 Tag: Tracking down account lockouts Tag: 176339
  - 24
    - M,I.5 Persecution ' purpose in publi cizing it; censorship in u k.* news groups -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= -= purpose in publicizing it;. censorship in uk.* newsgroups -= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= The postings to uk.misc newsgroup generated a very defensive reaction. from Usenet. readers in the UK. So much so, that they tried strenuously to suppress what. was being said, both by breaking the rules of netiquette in their responses on the forum, and directly. by action to revoke the account from. which the postings were issued. Yet the postings. were within the normal boundaries of behaviour for uk.misc, and other less. partisan spectators did not see justice in the censorship which was. effected, as the following excerpt shows; :Karen Lofstrom. (lofstrom@lava.net) wrote :>It. does seem that the frequency and the size of his posts are :>approaching net abuse. However, IMHO, they aren't quite. there yet. If :>his postmaster. were to act in this instance, it would raise troubling :>censorship. issues. The inescapable conclusion of the censorship. effected on the uk.* newsgroups is that the British are intent on. their wrongdoing remaining concealed, and therefore seek to subvert and suppress freedom. of speech, not only in their own country where the media shows xenophobic bias. and bile against all perceived enemies. within and without, but also in other countries which have their own statutes to guarantee the. basic human right of. free speech. It is absolutely necessary to bring their hate campaign out into the. open where it can be placed under scrutiny and the. harassers seen for what they are. That is. the only way of making it impossible for the security services to carry it out. There is a wider dimension, though.. Xenophobia as demonstrated by British people. and institutions over the last few years belongs to the same stable. as racial hatred. In one case, two youths on a Tube train made that racism explicit by referring to their. victim as a "soft toy, not up to. British Standards". Doubtless others victimize partly on the basis of. race (isn?t it odd that they chose to torment someone who is. not ethnically English?) while expressing their abuse in terms of another genetic attribute, namely. mental illness. All xenophobia on a genetic basis is wrong,. but while racial insults are illegal, abusing the mentally ill is neither against the law. nor subject to similar condemnation when it. is exposed. 6607 Tag: Tracking down account lockouts Tag: 176337
  - 25
    - M'I-5,Pers ecution ' abu se in se t-up situati ons and in pub lic -=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=- -= abuse in set-up. situations and in public -= -=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=- Strangers in the street have recognized me on sight. many times, and shown awareness of the current thread of abuse. To give. you one example, in 1992 I was seriously ill, and a manager. at work somewhat humorously said that "it wasn't fair" that people were bullying me. A. few days later, I attended for the first time a clinic in London as an outpatient, and. on my way out was accosted by. someone who asked if "they had paid my fare", with emphasis on the word "fare". He repeated the. word several times in this different context;. that they should have paid my "fare", each time emphasizing the word. For. two and a half years from the time their harassment started until November 1992 I refused to see. a psychiatrist, because I reasoned that I was not ill of my own action or fault,. but through the stress caused by harassment, and that a. lessening of the illness would have to be consequent to a removal of its immediate cause, in other. words a cessation of harassment. I also reasoned that since they were taunting. me with jokes about mental illness, if I were to seek treatment then the. abusers would think that they had "won" and. been proved "right". Remember, the constant theme of any persecution. is, "we must destroy you because you're X", whether X is a racial or other attribute. In this. case the X was "we persecute. you because you have brain disease". The similarity of this logic to Nazi attitudes to the mentally ill is. striking. The same manager. who'd said "it wasn't fair" asked me in winter 1992 why I didn't seek. help from a psychiatrist; was it, he asked, because "they would think they had won" if I sought treatment? That was something. I'd never said at work... again, taken separately it proves nothing,. but many such things. over a period of months proves conclusively that people in the company knew what was going on, and in quite a. lot of detail. Usually harassment in public lacks the level. of finesse of "paying your fare". Most people's imagination does not go beyond. moronic parroting of the current term of denigration. That is not surprising given. the average level of the abusers; if they. do not have the intelligence to distinguish wrong from right then neither will. they have the capacity for anything other than mindless repetition of a monosyllabic term. calculated to fit into. their minds. The first incidents of verbal assault in public were in again. in the summer of 1990, although they increased in frequency. and venom with time. In July 1990 the first public incident occurred on a. tube train on the Northern line. Two men and their girlfriends recognised me; the. women sprang to my defence, saying. "He looks perfectly normal, he doesn't look ill". Their boyfriends of course knew better, and followed the party line; one. of them made reference to an. "operation", apparently to work at the tube station but implicitly to a visit that I had made to hospital a couple. of weeks previously. In August 1990. going home from college, soon after getting on a tube train at Gloucester Road I was. followed by a group of four youths, who started a chant of abuse. That. they were targeting me was confirmed by other people in the carriage, one of whom asked the other. "who are they going on at, is it the bloke who just got on?" to which the second replied "yes, I. think so". I was tempted to reply, but as in every other instance the. abusers are enabled in their. cowardice by physically outnumbering the abused; any confrontation would result in my. being beaten up, followed by a complaint to the police that "he attacked us", and. of course he's ill, so he must have been imagining that we were. getting at him. Shitty, aren't they? But the. shittiness of the four youths on the tube train is as nothing compared. to the episode on the National Express coach to Dover in the summer of 1992. While going on holiday to the. Continent I was verbally set upon by a couple. travelling sitting a few rows behind. The boy did the talking, his. female companion contributing only a continuous empty giggling noise.. He spoke loudly to ensure other people on the coach heard, always about "they" and "this bloke" but never naming either the. abusers or the person he was talking about. He said. "they" had "found somebody from his school, and he was always really stressed at. school". They must have dug deep to find enemies there; perhaps someone. who dropped out of school, someone who didn't do too well later, who was jealous and keen to get. their own back? The. boy also said "he was in a bed and breakfast for only one night and. they got him". By a not unexpected coincidence I had been in a B&B in Oxford a week previously, which had been. booked from work; other things lead me to the conclusion that the company's offices. were bugged for most of the 2 1/2 years that I was there, so "they" would have known. a room in the B&B had been booked. (But. I'll bet "they" didn't tell the company's managers their offices were bugged,. did they?). After a few minutes of this I went. back to where they were sitting and asked where they were travelling. The boy named a village in. France, and the girl's giggling suddenly ceased; presumably. it permeated to her brain cell. what the purpose of the boy's abuse was. This and other set-up. situations are obviously calculated to provoke a direct confrontation which would bring. in the police, with the abusers claiming that they were the ones attacked. Again. in 1992, outside the house where I was. living in Oxford I was physically attacked by someone - not punched, just grabbed by the. coat, with some verbals thrown in for good measure. That was something the people at work shouldn't. have known about... but soon after a couple of people were talking right in. front of me. about, "I heard he was attacked". The UK police have a responsibility for preventing assault occurring, but they do not seem to. take any interest in. meeting that responsibility. I suppose their attitude is that harassment does not come within. their remit unless it involves physical assault, and they will only become involved. once that happens. That is of course quite the wrong attitude for them to take, but as I now understand, the. police investigate only the crime they wish to investigate; if they do. not take your complaints seriously then there is nothing you. can do to make them take. action. 4177 Tag: Tracking down account lockouts Tag: 176336

From a domain controller, is there a way to see which workstation
incorrect logins/account lockouts are coming from? Everything I can
find says you have to go to the workstation to identify what is
generating the incorrect logins. I don't care so much at this point
what is generating them, I need to identify the workstation they are
coming from.

Thanks
Jason

Top

Re: Tracking down account lockouts by Jorge

Jorge
Thu Feb 14 12:44:02 PST 2008

use NETLOGON debug logging

Enabling debug logging for the Net Logon service
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\DBFlag
DBFlag = 0x2080FFFF (in: %windir%\debug\netlogon.log)

google for "NETLOGON debug logging" and you will find more info

--

Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Windows Server - Directory Services

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* How to ask a question --> http://support.microsoft.com/?id=555375
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
<rop.jason@gmail.com> wrote in message
news:b3a9e6f2-6d84-407d-9a4d-e6bae01b3dc0@b74g2000hsg.googlegroups.com...
>
> From a domain controller, is there a way to see which workstation
> incorrect logins/account lockouts are coming from? Everything I can
> find says you have to go to the workstation to identify what is
> generating the incorrect logins. I don't care so much at this point
> what is generating them, I need to identify the workstation they are
> coming from.
>
> Thanks
> Jason

Top