Enable AD auditing on all the DC's
Search the event logs on their AD for event id 4771 in security section
Lockout tools may help
https://www.microsoft.com/en-us/download/details.aspx?id=18465
ManageEngine AD audit plus can help too (just parses event logs)
No comments:
Post a Comment