JSI Tip 7063. Account Lockout and Management Tools.

The Microsoft Account Lockout and Management Tools page contains:


ALTools.exe contains tools that assist you in managing accounts and in troubleshooting account lockouts. Use these tools in conjunction with the Account Passwords and Policies white paper.

ALTools.exe includes:

  • AcctInfo.dll. Helps isolate and troubleshoot account lockouts and to change a user's password on a domain controller in that user's site. It works by adding new property pages to user objects in the Active Directory Users and Computers Microsoft Management Console (MMC).

  • ALockout.dll. On the client computer, helps determine a process or application that is sending wrong credentials.

  • Caution: Do not use this tool on servers that host network applications or services. Also, you should not use ALockout.dll on Exchange servers, because it may prevent the Exchange store from starting.
  • ALoInfo.exe. Displays all user account names and the age of their passwords.

  • EnableKerbLog.vbs. Used as a startup script, allows Kerberos to log on to all your clients that run Windows 2000 and later.

  • EventCombMT.exe. Gathers specific events from event logs of several different machines to one central location.

  • LockoutStatus.exe. Determines all the domain controllers that are involved in a lockout of a user in order to assist in gathering the logs. LockoutStatus.exe uses the NLParse.exe tool to parse Netlogon logs for specific Netlogon return status codes. It directs the output to a comma-separated value (.csv) file that you can sort further, if needed.

  • NLParse.exe. Used to extract and display desired entries from the Netlogon log files.

NOTE: See How do I use the EventCombMT tool to search multiple computers for account lockout events?

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.