Windows

The Administrator can re-inable the account, change the password and access the data. This will work even if the data is encrypted. Another solution is for the Administrator to take ownership of the data file. See KB 268019.

Under Administrative Tools there is a local security settings tab. Under that there are Audit tabs such as Audit failed logins. If failed log ins by unauthorized users are locking the accounts you refer to then the info would show up in the audit log.

There is no direct attribute for the date an account was disabled. The closest LDAP attribute might be whenChanged since in theory the last change to the account should have been disabling it. You would have to write an LDAP query to get this attribue and test to make sure that no normal routines would update that field after the account is disabled. Good Luck!

This question was auto-closed because it is 90 days old

This question was auto-closed because it is 90 days old