You need to identify all failed logon attempts on the domain controllers.
What should you do?
A.
View the Netlogon.log file.
B.
View the Security tab on the domain controller computer object.
C.
Run Event Viewer.
D.
Run the Security and Configuration Wizard.
Explanation:
http://support.microsoft.com/kb/174074
Security Event Descriptions
This article contains descriptions of various security-related and auditing- related events, and tips for
interpreting them.
These events will all appear in the Security event log and will be logged with a source of “Security.”
Event ID: 529
Type: Failure Audit
Description: Logon Failure:
Reason: Unknown user name or bad password
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 530
Type: Failure Audit
Description: Logon Failure:
Reason: Account logon time restrictionviolation
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 531
Type: Failure Audit
Description: Logon Failure:
Reason: Account currently disabled
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 532
Type: Failure Audit
Description: Logon Failure:
Reason: The specified user account hasexpired
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 533
Type: Failure Audit
Description: Logon Failure:
Reason: User not allowed to logon at this computer
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 534
Type: Failure Audit
Description: Logon Failure:
Reason: The user has not been granted the requested logon
type at this machine
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 535
Type: Failure Audit
Description: Logon Failure:
Reason: The specified account’s password has expired
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 536
Type: Failure Audit
Description: Logon Failure:
Reason: The NetLogon component is not active
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6
Event ID: 537
Type: Failure Audit
Description: Logon Failure:
Reason: An unexpected error occurred during logon
User Name: %1 Domain: %2
Logon Type: %3 Logon Process: %4
Authentication Package: %5 WorkstationName: %6