AD user continuously gets account locked out

[almaragni]

I have a user who's account is continuously getting locked out. I've checked the security logs and cannot seem to find anything special. We use some sharepoint and citrix.

any ideas? thanks

 

[Roadki11]

First thing i would do is tell them to quit entering their password in wrong so many times. then i might look for an old scheduled task that is running with that users old credentials.

RoadKi11

 

[almaragni]

Thanks for the tip. We checked scheduled tasks on all servers and pc's involved; but no luck.

We even also changed the password - thinking maybe a change of pace would avoid errors. Still no luck.


Thanks anyway. Maybe someone has another hint.

 

[NickFerrar]

Download and run MS's account lockout tools, they can help track down the source of the problem. Lots of stuff can cause it, you also need to check security logs on each DC (assuming you have multiple DCs).

Hardest one I've had to track down turned out be be a disconnected terminal service session, seems although it's disconnected it still polls occassionally and the password is checked so if you leave a disconnected session then change your password you get lockouts after a while.

 

[jshurst]

I was continuously getting locked out once and it turned out to be some old creds running through sql server reporting services (scheduled delievery). Not saying that this is your problem, just giving an example - because it can be really hard to track down.

 

[biglebowski]

Check for any services that run under the domain account they may have the wrong password.

When I was born I was so suprised I didn't talk for 18 months

 

[monsterjta]

Do you see any failed security events being logged for that user account? If so, it could be possible that this user account is being password guessed. If that's the case, you should be able to track the source using information in the event logs.

Hope This Helps,

Good Luck!

(Enamoration by Automation)

 

[almaragni]

Thanks everyone so far. GOt some good leads.

Got a login watcher- downloaded - and trying to figure out how to use.

Also looked at security log and found hidden under system user - PRE-AUTHENTICATION errors ... KRBTGT service..
am checking into this first

 

[almaragni]

Well no luck yet...

THe logon tool was only able to show me the accoount and reset the lockout. The log viewer showed me "675" pre-authentication failure audits - but these were coming all from my citrix box .. which indicates that they are most likely the result of the lockout - not the cause.

Are there some other helpful hints out there?

Thank you

 

[markdmac]

I have seen this many times when a user is left logged onto a machine somewhere and forgot they were logged on. they log onto a second machine and later change their password. The first machine periodically checks in with the DC and passes the old credentials quickly causing a lockout.

You can use vbscript to query all of your Workstations & DCs to see where the user is getting locked out from.


I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript