Account continually locked out

[pikk67]

Hi

I have a user on my server that continues to have his account lock him out for no reason. It happens every couple of hours and I cannot determine what the cause is. I do know that at one point a week or two ago, he did login to a Workgroup machine and stayed logged in for quite a few days but I have since taken that system out fo the workgroup and renamed his PC.

Anyway, the only thing I have not done yet (and don't really want to) is remove him completely from the domain...

Any ideas?

P'

 

[compuveg]

Check for services running with his login credentials.

 

[markdmac]

I would bet that the user is logged onto another PC somewhere.

Here is a scritp I wrote that will help you to determine from where they are getting locked out. You need to provide a list of all workstation and server names.

'==========================================================================
'
' NAME: getLockoutLocation.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spider's Parlor
' URL: [URL unfurl="true"]http://www.thespidersparlor.com[/URL]
' DATE  : 1/4/2004
'
' COMMENT: <comment>
'
'==========================================================================

On Error Resume Next

'open the file system object
Set oFSO = CreateObject("Scripting.FileSystemObject")

'open the data file
Set oTextStream = oFSO.OpenTextFile("wslist.txt")
'make an array from the data file
RemotePC = Split(oTextStream.ReadAll, vbNewLine)
'close the data file
oTextStream.Close
report = ""

For Each strComputer In RemotePC
	Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
	Set colItems = objWMIService.ExecQuery("Select * from Win32_UserAccount",,48)
	For Each objItem in colItems
	    If objItem.Lockout = "False" Then
	        report = report & "User: " & objItem.FullName & " is locked out on " & strComputer & vbCrLf
	    End If
	Next
Next


Set ts = oFSO.CreateTextFile ("LockoutLocation.txt", ForWriting)
ts.write report
Set oTextStream = nothing
set ts = nothing
set oFSO = nothing

I hope you find this post helpful.

Regards,

Mark

 

[compuveg]

Great script. It is a shame Microsoft doesn't have better accounting and auditing.

 

[jshurst]

Did you get this resolved?

I was having this problem too (I'm not a sys admin), but my admin narrowed it down the the server that kept causing the problem. We had installed sql server reporting services on this server and somehow a job (using my credentials) kept failing. I'm not sure if the credentials were incorrect or what, but as soon as I killed the schedule it didn't lock out anymore.