No announcement yet.

Event 644 & Local Administrator account

  • Filter
  • Time
  • Show
Clear All
new posts

  • Event 644 & Local Administrator account

    I hope this is the best forum to post this question....

    I notice that there are regular Event 644 logged on the 3 DC's we have that are corresponding to when an administrator is logged on to servers using the local Administrators account. Pasted below is the event from one of the DC's:

    644,AUDIT SUCCESS,Security,Fri Apr 11 17:06:59 2008,NT AUTHORITY\SYSTEM,User Account Locked Out: Target Account Name: Administrator Target Account ID: %{S-1-5-21-934000765-65658062-1305049186-500} Caller Machine Name: SERVER-1 Caller User Name: SERVER-DC1$ Caller Domain: OUR-DOMAIN Caller Logon ID: (0x0,0x3E7)

    Of course, the local Admin account doesn't get locked out but I would like to find out why this is happening. I believe it is related to the logon process but not sure exactly why.

    Thanks in advance for any clues

  • #2
    Re: Event 644 & Local Administrator account

    Here is some info from Microsoft regarding the issue you are having.
    MCITP:SA, MCSA 2003, MCP, CCNA, A+, Net+, Security+


    • #3
      Re: Event 644 & Local Administrator account


      Thank you for your reply. Unfortunately it refers to NT rather than Server 2003... I will keep looking...