An account (on a NT domain) is locking up once in a while and I'm trying to
find out from which workstation. I've read that I could replace the
netlogon.dll and tweak the registry to get some info. But I have yet to find
the checked netlogon.dll. The old Microsoft link for the "Service Pack 6a
Checked Build"
(http://www.microsoft.com/ntserver/nt...ld/default.asp) is not working anymore....

Anybody can guide me to that checked netlogon? (Or give me another mean to
find the workstation in question.)

Thank you.

How about turning on auditing for logon/logoff success and failure
then checking the event viewer on all DCs?

"Sylvain" <Sylvain@discussions.microsoft.com> wrote in message news:
> An account (on a NT domain) is locking up once in a while and I'm trying
> to
> find out from which workstation. I've read that I could replace the
> netlogon.dll and tweak the registry to get some info. But I have yet to
> find
> the checked netlogon.dll. The old Microsoft link for the "Service Pack 6a
> Checked Build"
> (http://www.microsoft.com/ntserver/nt...ld/default.asp)
> is not working anymore....
>
> Anybody can guide me to that checked netlogon? (Or give me another mean
> to
> find the workstation in question.)
>

Hi Michael,

It's already turned on. I finally found the workstation. I kept looking at
the wrong thing in the security log: I was looking for entries for that user
thinking I would see an invalid attempt to log in. But I had to look for
event 644 (account being locked by SYSTEM) to find which workstation was
logged with that account.

So I was able to log out the account and fix the problem. Thanks.

Sylvain


"Michael Giorgio - MS MVP" wrote:

> How about turning on auditing for logon/logoff success and failure
> then checking the event viewer on all DCs?
>
> "Sylvain" <Sylvain@discussions.microsoft.com> wrote in message news:
> > An account (on a NT domain) is locking up once in a while and I'm trying
> > to
> > find out from which workstation. I've read that I could replace the
> > netlogon.dll and tweak the registry to get some info. But I have yet to
> > find
> > the checked netlogon.dll. The old Microsoft link for the "Service Pack 6a
> > Checked Build"
> > (http://www.microsoft.com/ntserver/nt...ld/default.asp)
> > is not working anymore....
> >
> > Anybody can guide me to that checked netlogon? (Or give me another mean
> > to
> > find the workstation in question.)
> >
>
>
>

Glad to hear Sylvain.

Thanks for the update!

Michael
"Sylvain" <Sylvain@discussions.microsoft.com> wrote in message news:
> Hi Michael,
>
> It's already turned on. I finally found the workstation. I kept looking
> at
> the wrong thing in the security log: I was looking for entries for that
> user
> thinking I would see an invalid attempt to log in. But I had to look for
> event 644 (account being locked by SYSTEM) to find which workstation was
> logged with that account.
>
> So I was able to log out the account and fix the problem. Thanks.
>