Open Event Viewer on DC;
And Filter on Logon/Logoff events to start off with.
Event ID is 529 for locked and 675 for logon attempts.
Client address will be listed in the failure.
Sunday, March 22, 2009
Finding source of denial of service attacks in AD/ Conficker Virus
Subscribe to:
Post Comments (Atom)
Subscribe To This Web Site
Posts
Comments
No comments:
Post a Comment