Send Knowledge Base Article
The article has been sent to your inbox successfully.
We never share your data
How does NetWrix Account Lockout Examiner work
How do I use NetWrix Account Lockout Examiner to track lockouts? How can I use this tool?
KB1335 | Last review: Aug 16, 2017 | Netwrix Account Lockout Examiner | All versions
|NetWrix Account Lockout Examiner tracks account lockouts in real time, enables proactive lockout resolutions, and helps administrators to effectively troubleshoot account lockouts.
Account Lockout Examiner is able to determine the origins of lockouts and show detailed information about specified lockouts and invalid logons.
Refer to Administrator's guide in order to get information about installation and setting up of NetWrix Account Lockout Examiner
The Account Lockout Examiner tool processes Windows security logs without using agents so that the audit policy in the domain be setup, according to the requirements of the tool.
Configuration of the audit policy is described in the admin guide and this KB: http://www.netwrix.com/kb/1571
Since Windows Security log is the only source, Accoount Lockout Examiner is able to show only the information that is present in the log.
After Account Lockout Examiner finds a lockout event, it adds the information about account lockout to the list in the Summary tab. Administrator can investigate an account lockout with the help of the Examination feature. To run an examination, an administrator clicks the Examine button at the bottom of the list in the Summary tab, or right-clicks an account and select Examine. Examination shows a list of invalid logons, specifies the names of the processes that have used invalid credentials, and checks the most common reasons of lockouts: mapped drives, scheduled tasks, RDP sessions, and services running under credentials of the account in question.
Examination results look like this:
For more details on interpreting the reults refer to the Administrators guide.
Was this information helpful?