Printable View
I was thinking it it was possible to show what users are currently locked out in am MMC for users and computers? I have delegated the rights to unlock accounts. However, due to different hours the persons that now can unlock an account is not always available and the account gets locked out. It will be fine if that person just can open their OU look at the user accounts there and check if anyone got locked out last night. Thanks
I dont think that accounts lock out themselves. There could be always some reason for wrong password attempt, etc. Incase you dont care about who has control about you can just disable that option in the GPO. So that no accounts will lock out, which is not recommended. But if anyone is able to unlock the account, then it will be a useless feature.
You will just need to set the accounts to unlock themselves after 10 minutes in Account Lockout Policy. There is a plenty of time to stop someone from trying to break into your accounts. Just go to Default Domain Policy > Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy and set the Account Lockout Duration to 10 minutes and Account Lockout Threshold to 25 invalid attempts and Reset Account Lockout Counter After to 10 minutes.
To search for locked-out user accounts, you need to first query Active Directory Directory Services (AD DS) for user accounts. Then go through the user accounts querying the IsAccountLocked property, and print out the distinguishedName attribute of the user. Check for some more information from here - http://blogs.technet.com/b/heyscript...-accounts.aspx
Try to checkout the account lockout tools from the below link:
http://technet.microsoft.com/en-us/l...72(WS.10).aspx
http://www.microsoft.com/en-us/downl....aspx?id=18465
Also, there could be some issues with the conficker, so go through the below link to solve that issue incase:
http://support.microsoft.com/kb/962007