Account Lockouts after password change

We have multiple users that everytime they change their passwords (30 day expiration) they continually get account lockouts. I believe the problem is happening because these users are logged on to other workstations in the domain with the old password. Is there a way to determine which workstations a user account is actively logged into.

Thanks for your help.
 
VBHunterAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

jhanceCommented:
You should be seeing failed logons in your server event log.
0
boxcar7Commented:
You may have to turn on appropriate auditing to see failed logons.

The other thing you might want to check to see is if they have any services on their workstations logging in under their user account.  I had a user with MS's indexing service running under his own account and causing lockouts, almost immediately after he changed his password.
0
darth_wannabeCommented:
You might be able to write a script using a tool like PSLOGGEDON ( http://www.sysinternals.com/ntw2k/freeware/pstools.shtml ) that would do what you want.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

mreiCommented:
We had the same thing after we changed our security policy. We turned on auditing and then saw known batchfiles running under Task Scheduler within user contexts. However, that user contexts needed to be reconfigured with new passwords, too, after each forced password change. Watch your event logs, as boxcar7 said.
0
mreiCommented:
>> ... Is there a way to determine which workstations a user account is actively logged into. ...

net session [\\computername] will do that; try also net view / net statistics / net share / net use; or use the GUI-Version; go to Start / Run and enter srvmgr; at the program doubble-click the workstation and navigate through Users, Shares, In use, ...
0
VBHunterAuthor Commented:
What I would like, is to provide USER ACCOUNT and get a list of all hostnames that account is connected to.

Thanks
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.