Unknown source locking a domain administrator account

Question

I try to find a source which is locking a domain administrator account.

SamLogon: Transitive Network logon of (null)\ADMINISTRATOR from (via DC2) Returns 0xC000006A

I have enabled debug loggin for the Netlogon service.

https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-security/enable-debug-logging-netlogon-service

Nltest /DBFlag:2080FFFF

Still no success to find a right source.

Any tips?

Answer 1

Hi @T. Kujala

Have a look at this article which provide details on how to troubleshoot locked accounts.

https://nettools.net/troubleshoot-account-lockouts/

Gary.

Answer 2

Thank you very much @Gary Reynolds . This really helps.

Have a good time!