Hi, I was wondering if someone could clarify something for me. We have found that when lockout examiner is run, the server it is running on establishes connections you can see with a NetStat -A command to random workstations. When it is disabled the connections don't happen. Why would it be doing that? I thought it simply monitored the Event logs of the domain controllers.
Does any one know the reason for this?
Any clarification would help.