Let us see the account lockout event ids in Windows Server 2003:
Event Id | Event Type | Event Occured | Reason |
---|---|---|---|
529 | Failure Audit | Logon Failure | Unknown user name or bad Password |
539 | Failure Audit | Logon Failure | The user trying to logon is already locked |
612 | Policy Change | Policy Changed | General Audit Policy changed |
643 | Policy Change | Domain Policy Changed | Changes in Account Lockout and Password policis |
644 | Success Audit | User Account Locked Out | The user account has reached the account lockout threshold |
671 | Success Audit | User Account Unlocked | User Account Unlocked |
675 | Failure Audit | Logon Failure | Pre-authentication failed |
Event Id | Event Type | Event Occured | Reason |
---|---|---|---|
4625 | Failure Audit | Logon Failure | Unknown user name or bad Password |
4719 | Policy Change | Policy Changed | General Audit Policy changed |
4739 | Policy Change | Domain Policy Changed | Changes in Account Lockout and Password policis |
4740 | Success Audit | User Account Locked Out | The user account has reached the account lockout threshold |
4767 | Success Audit | User Account Unlocked | User Account Unlocked |
4771 | Failure Audit | Logon Failure | Kerberos Pre-authentication failed |
Leave a comment