Tracking locked AD accounts

The beans recently modified the password for Sophos's upgrade account, which resulted in frequent lock-in of the account. I need to find out exactly which clients are configured with the wrong password to cause this problem. The method is simple and very traditional. In a word, locate the corresponding DC, and then locate the corresponding login user and computer from the DC log.

First, confirm that the corresponding auditing function is opened in the Group Policy. Only with the Enable Audit Kerberos Authentication Service can we view the 4771 event.

Then you need to download a tool that will help us locate the domain on which the user is logged on

http://www.microsoft.com/en-gb/download/details.aspx?id=15201

Enter the name of the user you want to query

He will list the corresponding domain control and the use time of the wrong password

Log in to the corresponding domain control and view security's 4771 logs.

Find the corresponding point in time, open

You can see the IP address of the client.

Then, depending on the client's operating system, SSH or RDP connections are on the line.

Tracking locked AD accounts