Server 2003 Account Lockout Troubleshooting

[trckn4life]

There is another worker in the IT deparment where I work that he just told me he was locked out of his account at least twice today. It's slipping my mind as to where to go to figure out more information to see if someone else is trying to use his account to login with privlidges. Where should I go to check this? By the way he is logging into a 2003 AD Domain. I did a some looking on the server and haven't turned up the info I was hoping for.

Event Log? Under the username it didn't list last logon attempt or what machine it was coming from. Any suggestions would be greatly appreciated.

 

[QHalo]

Look for Event 539 in the Security Log on the domain controller. It will list the offending computer name and the account.

 

[jonw757]

use eventcomb and search for his user id on the dc

 

[oakfan52]

search google for account lockout toolkit from microsoft.