How can i find out which Conficker infected systems are causing my AD accounts to be locked out ?

  • 1
  • Question
  • Updated 8 years ago
  • Answered
Determine if any PC infected with Conficker that is brute forcing accounts on the domain.
Photo of NetFort

NetFort

  • 182 Posts
  • 2 Reply Likes

Posted 8 years ago

  • 1
Photo of NetFort

NetFort

  • 182 Posts
  • 2 Reply Likes
Official Response
Run the report - Security - Events - By signature. Search for the event 'netbios smb-ds repeated logon failure. Drilldown to reveal the hosts trying to connect