account lockout

[shazzam1]

If the user is only entering their login ID and password couple of time and our GP is setup to lock an account after 5 tries. Can anyone help me to monitor why this happens to this individual? Her account locks up everyday, there are no security warnings in the event viewer, can't figure out why this happens only to this one employee out of 100

 

[NetIntruder]

I had something similar where the user had a service set to run as their account... when they changed their password, they didn't change the service, so the service was trying to authenticate unsuccessfully and was locking the account out.

Are you monitoring unsuccessful logon attempts on your domain controller(s)?

~Intruder~
CEH, CISSP, MCSA/MCSE 2000/2003

 

[basst]

Use Microsoft resource kit tool Lockoutstatus.exe to determine which DC is locking out the users account. From this you can then determine from the security logs on the DC roughly when the account gets logged out.

If the user was performing a particular task at that time you may be able to tie the lockuot to this.

I recently had a user with a mapped printer in which he had entered and saved his account credentials.

Using the above method i established that the account was being locked whenever he opened Word and then went to print a document. As Word built the list of avalable printers it would try to access the mapped prineter which had an old password specified. Then his account was locked out.

 

[shazzam1]

Thanks that was the issue had a mapping to an old server