Slow examination

Email It to Me Print this Page
Symptoms Examination of lockouts runs for several hours without returning any results.
Cause During examination Account Lockout Examiner service connects to the workstation where the lockout occurred and scans it.
Time of examination depends on several factors, e.g.
  • Bandwidth of the connection to the workstation - for workstations located on other continents examination might run for a long time
  • The Account Lockout Examiner service load - if there are a lot of events to process in your environment, the service might not have resources to perform the examination
  • Permissions or connection issues.
  • etc
Resolution Ensure that:
  1. Workstation is reachable from the Account Lockout Examiner server.
  2. Connection is not blocked by the firewall.
  3. Cpu and Memory usage of Account Lockout Examiner (ALEService.exe process) is normal
  4. The Account Lockout Examiner service account has local administrator permissions on the target workstation.
  5. There is not a network bottleneck between the two endpoints (Account Lockout Examiner and target workstation).

It is recommended to perform examination of workstations located in the same site with the Account Lockout Examiner host machine.  Using separate installations of Account Lockout Examiner for other sites is recommended.

If all above factors are OK, please try to perform the steps from the  following articles and re-run examination:

http://www.netwrix.com/kb/1385
http://www.netwrix.com/kb/1531
http://www.netwrix.com/kb/1328
(*) Netwrix Auditor replaces former Change Reporter products
Was this information helpful?