Account Guest

Hello, 

Iam getting every few minutes a message that tells me that the account GUESTS is getting locked.

The domain guest account is disabled in our domain(i didn't know that a disabled account can be locked)

also the real username of guest account is changed to something else.0

i am getting thos messages fron my dc's.

what can it be? any idea ?

Parents Reply
  • Oh, sorry, this alert comes from DC. OK.

    <?xml version="1.0"?>
    <rule type="REL" version="1.0">
    <arguments>
    <argument displayname="Exclude Workstations" name="Exclude_Workstations" class="List" description="A list of workstation names to exclude from monitoring.">
    <value>"Exclude_Workstation"</value>
    </argument>
    </arguments>
    <prefilter>
    EventID = 4740;
    </prefilter>
    <body>
    def common(OperatorDomain, OperatorName) :=
    {
    set_alert_field("OperatorName", OperatorName, true)
    and set_alert_field("OperatorDomain", OperatorDomain, true)
    }
    EventID = 4740
    and not(in(String2, "wi", array(<parameter name="Exclude_Workstations"/>)))
    and common(String6, String5);
    </body>
    </rule>

Children