Event Id539
SourceSecurity
DescriptionLogon Failure:
Reason: Account locked out
User Name: <User Name>
      Domain: <Domain>
      Logon Type: <Logon Type>
      Logon Process: <Logon Process>
      Authentication Package: <Authentication Package>
      Workstation Name:<Workstation Name>     

Event InformationCause:
A logon attempt was made and rejected because the account has been locked out. An account gets locked out after the number of unsuccessful logon attempts exceeds the preset limit established in the domain policy.

Resolution:
The administrator must re-enable the account.
Reference LinksTracking Logon and Logoff Activity in Windows 2000 (Article)

Alternate Event ID in Vista and Windows Server 2008 is 4625.

Tracking Logon and Logoff Activity in Windows 2000



  Did this information help you to resolve the problem?
  Yes: My problem was resolved.
  No: The information was not helpful / Partially helpful.
  Comments:

Captcha  Refresh