Take Advantage of the EventCombMT Utility

Using the Built-In Searches
EventCombMT contains built-in searches, such as the search for duplicate SIDs in AD, FRS failures, and hardware disk errors. One of my favorite built-in searches is the search for account lockouts. Finding which DC is responsible for locking out a user and the events leading up to the lockout isn't an easy task if done manually. To load this predefined search, select Built In Searches, Account Lockouts on the Searches menu. The utility automatically selects the DCs and the account-lockout events that Table 1 lists.

Accounts typically get locked out in the following manner: When a user attempts to log on and fails because of a bad password, each attempt is logged with event ID 529. After the account has exceeded the maximum number of attempts and the account is locked out, the PDC emulator records event ID 644 to mark the occasion. Subsequent attempts to log on using the locked out account are logged on the DC with event ID 539. . . .