Lock changed

[Former Member]

Hello,

For the auditors I need the answer to the follwing question:

In the list of changes related to users accounts (produced via SUIM) I see the following entry:

User Name Date Time Changed by Action Old Contents of Changed Field Text New Contents of Changed Field Text TCode

TESTACC 05/23/2008 13:55:53 TESTACC Lock Changed 0 Not Locked 128 Incorrect Logon Lock KRNL

Action says: Lock changed, and Text said "Not Locked". Why Text says "Not Locked"?

Thanks

Galina

[Former Member · Accepted solution]

Hi Galina,

unfortuantley your formatting got lost, so you should usually see the relevant text under the correct header line in your reporting. I can currently not tell from your SDN post which value belong to which header line field.

I assume in your case, that the user has been changed from "Not locked" to "Lock" due to too many incorrect logon retries. And this has been set by a KRNL (kernel) routine.

Best regards,

Silvia

[Former Member]

Silvia, you are correct. I just figured this out.

Thanks

Galina

[Former Member]

Silvia,

Thanks for your reply.

Here is the same line in different format where each field has its value next to it. I understand that user was not locked and then got locked due to multiple logins. What I did not understand is why Text said Not Locked. And auditors did not understand this as well.

User Name: TESTACC

Date: 05/23/2008

Time:13:55:53

Changed by: TESTACC

Action: Lock Changed

Old Contents of Changed Field: 0

Text: Not Locked

New Contents of Changed Field: 128

Text: Incorrect Logon Lock

TCode: KRNL

It makes sense now.

Galina

[Former Member]

Hi Galina,

I think that the auditor and you have to take the "old" into regards here.

When you read it like this:

Old Contents of Changed Field: 0

Text: Not Locked

And afterwards you read this:

New Contents of Changed Field: 128

Text: Incorrect Logon Lock

then everything works out.

Best regards,

Silvia

[Former Member]

Hi,

This indicates that the User was locked and have unlocked. I am doubtful with the details about the text you got, probably that might have miss-interpreted.

It will be gr8 if you can share any screen shot of it. coz..just givein the discritpion will not lead to clarify anything

Thanks

Swarup