Jump to content


Photo

Netwrix Account Lockout Examiner - Logon Auditing is Disabled - But it's not..


  • Please log in to reply
4 replies to this topic

#1 tscott

tscott

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 21 February 2016 - 03:14 AM

I have a user who is getting locked out and can't figure out why.. Downloaded this tool in hopes to help.. See below.. It's not providing any useful info yet the policy is in place.

Thanks

Policy set:

Screen1.jpg

 

Modeling Verifies:

Screen2.jpg

Error:

Screen3.jpg



#2 dsmirnov

dsmirnov

    Advanced Member

  • Root Admin
  • PipPipPip
  • 58 posts
  • Gender:Male

Posted 22 February 2016 - 11:39 AM

tscott,

 

It could happen that policies have not applied.

 

Try executing auditpol /get /category:* on a DC to get effective audit policy settings.



#3 rdirkmatt

rdirkmatt

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 04 March 2016 - 10:32 PM

same problem here: checked with command line and it appears to be on?

 

Attached Files



#4 thwack

thwack

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 12 April 2016 - 02:19 PM

Just started the 20-day demo and ran into the same problem. All domain controllers and the domain have logon auditing enabled.

 

Has anyone been able to fix it?

 

Thanks



#5 i3laze

i3laze

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 16 May 2016 - 03:49 PM

This article made my day:

https://blogs.msdn.m...stering-audits/

 

Search and delete all "audit.csv" (these are legacy files) inside "\\yourdomain\SYSVOL\yourdomain\Policies" folder.

Use "gpupdate" or just wait for a while. Profit!






0 user(s) are reading this topic

0 members, guests, anonymous users