I have a user who gets frequent account lockouts. Daily lockouts occur.its really frustrating.the only thing I have checked is, active rdp sessions. how else can i check which tool is sending the bad password.i have used altools, but it doesn't give me any info that i've not already seen in the eventlogs. please help!1 person needs an answerI do too

I'm assuming the lockout is due to failed logins... You should be able to use standard Windows Auditing tools to trace this. You will need to turn on "Audit Logon Events" in order for the system log to record these events to be displayed in Window's Security Log. Then you can use the Event Viewer to review the logs. To enable "Audit Logon Events", follow the procedure in the following KB article except instead of clicking "Audit Object Access", click on "Audit Logon Events" instead."How to audit user access of files, folders, and printers in Windows XP" < http://support.microsoft.com/kb/310399 >HTH, JW