VBHunter
asked on
Account Lockouts after password change
We have multiple users that everytime they change their passwords (30 day expiration) they continually get account lockouts. I believe the problem is happening because these users are logged on to other workstations in the domain with the old password. Is there a way to determine which workstations a user account is actively logged into.
Thanks for your help.
Thanks for your help.
You should be seeing failed logons in your server event log.
You may have to turn on appropriate auditing to see failed logons.
The other thing you might want to check to see is if they have any services on their workstations logging in under their user account. I had a user with MS's indexing service running under his own account and causing lockouts, almost immediately after he changed his password.
The other thing you might want to check to see is if they have any services on their workstations logging in under their user account. I had a user with MS's indexing service running under his own account and causing lockouts, almost immediately after he changed his password.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
We had the same thing after we changed our security policy. We turned on auditing and then saw known batchfiles running under Task Scheduler within user contexts. However, that user contexts needed to be reconfigured with new passwords, too, after each forced password change. Watch your event logs, as boxcar7 said.
>> ... Is there a way to determine which workstations a user account is actively logged into. ...
net session [\\computername] will do that; try also net view / net statistics / net share / net use; or use the GUI-Version; go to Start / Run and enter srvmgr; at the program doubble-click the workstation and navigate through Users, Shares, In use, ...
net session [\\computername] will do that; try also net view / net statistics / net share / net use; or use the GUI-Version; go to Start / Run and enter srvmgr; at the program doubble-click the workstation and navigate through Users, Shares, In use, ...
ASKER
What I would like, is to provide USER ACCOUNT and get a list of all hostnames that account is connected to.
Thanks
Thanks