Tracking locked AD accounts

The beans recently modified the password for Sophos's upgrade account, which resulted in frequent lock-in of the account. I need to find out exactly which clients are configured with the wrong password to cause this problem. The method is simple and very traditional. In a word, locate the corresponding DC, and then locate the corresponding login user and computer from the DC log.

First, confirm that the corresponding auditing function is opened in the Group Policy. Only with the Enable Audit Kerberos Authentication Service can we view the 4771 event.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/6B/6F/wKioL1Ut4ifRx9qpAANe9Si5wes029.jpg "title=" screen Shot 2015-04-15 at 1.52.12 pm.png "style=" Float:none; "alt=" wkiol1ut4ifrx9qpaane9si5wes029.jpg "/>

Then you need to download a tool that will help us locate the domain on which the user is logged on

http://www.microsoft.com/en-gb/download/details.aspx?id=15201

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/6B/6F/wKioL1Ut4hjxntZFAAGGmo0WZdI583.jpg "title=" screen Shot 2015-04-15 at 1.52.20 pm.png "style=" Float:none; "alt=" wkiol1ut4hjxntzfaaggmo0wzdi583.jpg "/>

Enter the name of the user you want to query

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/6B/74/wKiom1Ut4L7jUzJ9AAECxWgTO50275.jpg "title=" screen Shot 2015-04-15 at 1.52.26 pm.png "style=" Float:none; "alt=" wkiom1ut4l7juzj9aaecxwgto50275.jpg "/>

He will list the corresponding domain control and the use time of the wrong password

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/6B/6F/wKioL1Ut4g6D-4iAAAFoxQNNGLc623.jpg "title=" screen Shot 2015-04-15 at 1.52.32 pm.png "style=" Float:none; "alt=" wkiol1ut4g6d-4iaaafoxqnnglc623.jpg "/>

Log in to the corresponding domain control and view security's 4771 logs.

Find the corresponding point in time, open

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/6B/74/wKiom1Ut4LbwRCDHAANkCTfXnLM675.jpg "title=" screen Shot 2015-04-15 at 1.52.39 pm.png "style=" Float:none; "alt=" wkiom1ut4lbwrcdhaankctfxnlm675.jpg "/>

You can see the IP address of the client.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/6B/6F/wKioL1Ut4fygMU34AALmliFvxp8214.jpg "style=" float: none; "title=" screen Shot 2015-04-15 at 1.52.47 pm.png "alt=" Wkiol1ut4fygmu34aalmlifvxp8214.jpg "/>

Then, depending on the client's operating system, SSH or RDP connections are on the line.

This article is from the "Mapo Tofu" blog, please be sure to keep this source http://beanxyz.blog.51cto.com/5570417/1632880

Tracking locked AD accounts