Tools for Troubleshooting Locked-Out Accounts

Troubleshooting locked-out accounts can be difficult and time-consuming. Cached credentials on drive mappings, Microsoft IIS application pools, COM+ objects, scheduled tasks, services, and interactive logons are all common causes of account lockouts. Fortunately, Microsoft provides tools and techniques to help you narrow the search for the root cause, including the Account Lockout and Management Tools. You can download these tools from the Microsoft Download Center .

At my organization, we recently used the following tools to locate the root cause of a locked-out account that was discovered during one of our regularly scheduled password changes:

EventCombMT.exe. Event- CombMT.exe collects and filters events from the event logs of domain controllers (DCs) within a specified domain. This tool features a built-in search for account lockouts, which defaults the search to the security log. It populates the Event ID field with relevant event IDs (i.e., IDs of events that pertain to locked-out accounts). Consolidating the lockout events into text files in a common folder provides a quick way to search for the locked-out account and the name of the server or workstation from which the lockout originated.

LockoutStatus.exe. LockoutStatus.exe examines all DCs in a domain, letting you know when the target account last locked out and from which DC. In addition, it provides the locked-out account’s current status and the number of bad password attempts that have been made. Depending on the topology of the Windows domain, this information can help you determine whether the server or workstation locking out the account is located at a particular site.

Netlogon logging used for tracking Netlogon and NT LAN Manager (NTLM) events. Enabling Netlogon logging on all DCs is an effective way to isolate a locked-out account and see where the account is being locked out. The Microsoft article “Enabling debug logging for the Net Logon service” (support.microsoft.com/kb/109626) contains information about how to enable Netlogon logging on the various versions of Windows. Although Netlogon logging isn’t part of the Account Lockout and Management Tools, NLParse.exe is used to parse the Netlogon logs—and NLParse.exe is one of the account lockout tools. Enabling Netlogon logging can create large files quickly, so using NLParse.exe to locate relevant events in the Netlogon log can save time when troubleshooting lockouts. The output from NLParse.exe is extracted to comma-separated value (CSV) file, where it can be easily searched or sorted.

The Account Lockout and Management Tools helped us reduce the amount of effort it took to locate the root cause of our locked-out account. They helped us target our energy at specific servers or workstations in our organization.

—Brent McCraney,
Senior Technical Analyst,
Ontario Teachers’ Pension Plan