https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192554#M5668 <P>I'd suggest the password of record was not the actual password, unless you have direct evidence to the contrary. Did you keep the original password file intact, whith file date etc? Forensics are difficult once the evidence has been altered.</P> Thu, 12 Jun 2014 09:44:54 GMT grijhwani 2014-06-12T09:44:54Z https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192552#M5666 <P>Today we were unable to login to our splunk instance using the admin account. Had to reset the account using this procedure <A href="http://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password">http://answers.splunk.com/answers/834/how-could-i-reset-the-admin-password</A>. Everything is all set now but i am keen to understand what really messed up the admin account. Any logs you suggest which i can go through...?</P> Mon, 09 Jun 2014 13:05:46 GMT https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192552#M5666 anoopambli 2014-06-09T13:05:46Z https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192553#M5667 <P>Experts any ideas???</P> Thu, 12 Jun 2014 09:36:58 GMT https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192553#M5667 anoopambli 2014-06-12T09:36:58Z https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192554#M5668 <P>I'd suggest the password of record was not the actual password, unless you have direct evidence to the contrary. Did you keep the original password file intact, whith file date etc? Forensics are difficult once the evidence has been altered.</P> Thu, 12 Jun 2014 09:44:54 GMT https://community.splunk.com/t5/Security/admin-account-lockout/m-p/192554#M5668 grijhwani 2014-06-12T09:44:54Z