|
2/16/2005 -- Have you ever needed to track down when a user last logged in? Have you ever wanted to know when a user’s password was set to expire? These are common queries for network and security administrators as well as security auditors.
In case you haven't yet run across it, Microsoft has released a suite of tools that can help you troubleshoot, audit and document password and account lockout information for all users in your domain. The aptly named Account Lockout and Management Tools suite is a free download from Microsoft, available here. While many of the tools are extremly useful, in this column I focus on AcctInfo.dll, one of my favorite in the suite because it provides details about user accounts that used to only be available via a script.
Once downloaded, the suite of tools can be extracted to a folder on any local computer. After you extract and install AcctInfo.dll, you will see a new user’s property tab for each user account listed in Active Directory Users and Computers. The new user property tab is shown in Figure 1.
Figure 1: Additional Account Info tab created by AcctInfo.dll. (Click on image to view larger version.)
To get the DLL to show this new tab, you will copy the AcctInfo.dll file to the System32 folder of the computer where you run the Active Directory Users and Computers to administer domain user accounts. After you copy the DLL to the System32 folder, you will need to register the DLL by typing regsvr32 acctinfo.dll at a command prompt.
There are many ways to access the domain account policy settings, but this new tab also allows you to quickly access the domain account policy. If you click on the Domain PW Info button, you will trigger a new window, which displays the domain account policy information as shown in Figure 2, below.
Figure 2: Domain Account Policy is accessible from within the new Additional Account Info tab. (Click on image to view larger version.)
Another fantastic feature available on the Additional Account Info tab is the ability to reset the password for a user on a domain controller that is in the site associated with the user account. If the password is changed on a domain controller that is a different site than the user, the change might not get to a domain controller in the user’s site for some time (potentially many hours) due to replication latency. You are also able to unlock the user account from this interface, as shown in Figure 3.
Figure 3: You can control password and account status on a domain controller in the user’s site. (Click on image to view larger version.)
As you can see, this simple tool allows you to control and view password and account lockout information for each user without the need for complex scripts. The tool suite is also free and easy to install and use. Be sure not let the other tools in the suite go by without a quick look, especially Alockout.dll, aloinfo.exe and eventcombMT.exe. 
|
