A user is having account lockout problems and you need to determine where it is getting locked from and how it is getting locked out.
LockoutStatus is a new tool
for Windows 2000 or Windows Server 2003 that can help identify which
domain controllers users are getting locked out. It works by querying
the lockout status of a user against all domain controllers in the
To determine the lockout status of a user
LockoutStatus and select File →
Select Target from the menu.
Enter the target user name and the domain of the user.
At this point, each domain controller in the domain will be queried and the results will be displayed.
Lockoutstatus.exe tool is just one of many
that are available in the new “Account Lockout and
Management” tool set provided by Microsoft. These
new lockout tools are intended to help administrators with account
lockout problems that are very difficult to troubleshoot given the
tools available under Windows 2000. Along with the tool mentioned in
the Solution Section, here are a few others that are included in the
A script that uses this DLL called EnableKerbLog.vbs is included with the tool set that can be used to enable logging of application authentication. This can help identify applications using bad credentials that are causing account lockouts.
Displays services and shares that are using ...