There is an attribute for each account stored in the user object, but it's maintained on each DC separately (not replicated). It will reset once there is a "good" logon, but otherwise it counts how many bad attempts there were since the last good logon.
Open ADU&C with Advanced features toggled on. Browse down to the user account in question and look at properties, then the "Attribute Editor" tab. Look for "badPwdCount" to have a number, and "badPasswordTime" will have the timestamp of the last attempt. You would have to collect info from all DCs or know which DC the user authenticated with. Depending on what you need, maybe the MS account lockout & mgmt tools would help? https://www.microsoft.com/en-us/download/details.aspx?id=18465 -Bonnie From: [email protected] [mailto:[email protected]] On Behalf Of David McSpadden Sent: Monday, December 21, 2015 12:53 PM To: [email protected] Subject: [NTSysADM] number of failed attempts Is there a place in AD (2012) that I can find number of failed login attempts? David McSpadden System Administrator Indiana Members Credit Union P: 317.554.8190 [Description: Description: imcu email icon]<http://imcu.com/> [Description: Description: facebook email icon] <https://www.facebook.com/IndianaMembersCU> [Description: Description: twitter email icon] <https://twitter.com/IndMembersCU> [Description: Description: email logo] [http://www.amuletsolutions.com/images/mcp.gif]<http://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&cad=rja&uact=8&ved=0ahUKEwjFztf-tePJAhXK5iYKHcPtAxEQjRwIBw&url=http://www.amuletsolutions.com/awards.aspx&bvm=bv.110151844,d.amc&psig=AFQjCNHkrx8CednTEOOq4zUxYyrRUGzUsg&ust=1450459757284499> This e-mail and any files transmitted with it are property of Indiana Members Credit Union, are confidential, and are intended solely for the use of the individual or entity to whom this e-mail is addressed. If you are not one of the named recipient(s) or otherwise have reason to believe that you have received this message in error, please notify the sender and delete this message immediately from your computer. Any other use, retention, dissemination, forwarding, printing, or copying of this email is strictly prohibited. Please consider the environment before printing this email.
