|
Posted by cdmeyer on January 4, 2007, 2:12 pm
Please log in for more thread options The 539 event is logged on the server or workstation the user is on,
not on the Domain Controller (unless the user is trying to login
locally to the DC). See:
http://www.ultimatewindowssecurity.com/events/com200.html
On the domain controller, the events should be 644 (User Account Locked
Out) and 642 (User Account Changed).
Christopher Meyer - GCIH, CISSP
Roger Abell [MVP] wrote:
> sec event id 539
> see also
> http://support.microsoft.com/kb/840036
>
> > Hi. If possible could anyone please tell me what event entry is logged on
> > a 2003 domain controller when a user locks their account e.g. by
> > incorrectly entering their password beyond the password policy threshold ?
> >
> > Thanks for any help.
> >
> > Brian
> >
| 
XML Sitemap