mahjohn
asked on
User accounts "locked"
I have my LAN Domain, and my DMZ Domain separated via firewall. There is a terminal server in the DMZ, accessible via the Internet, and the LAN. When users in the LAN connect via RDP to the Terminal Server in the DMZ, they must use there user account in the DMZ, as there is no domain trust between LAN and DMZ domains. Users can also map a network drive from there LAN PC's to the server share in the DMZ, again, using there DMZ credentials to connect.
Problem:
LAN users that connect to the Terminal Server, are consistently finding that their user accounts are locked out. I have other users that use servers in the DMZ domain (Sharepoint), and none of them have this problem. Why are the Terminal Server user accounts being locked out so frequently?
Is it that the users are simply forgetting their passwords, or does it have something to do with the combination of using Remote Desktop, and mapping a network drive to the same server? If a drive is mapped from the LAN to a server in the DMZ, will Windows Explorer try to verify the directory and attempt a logon, each time they open "My Computer" ?
Any ideas or suggestions are appreciated.
Problem:
LAN users that connect to the Terminal Server, are consistently finding that their user accounts are locked out. I have other users that use servers in the DMZ domain (Sharepoint), and none of them have this problem. Why are the Terminal Server user accounts being locked out so frequently?
Is it that the users are simply forgetting their passwords, or does it have something to do with the combination of using Remote Desktop, and mapping a network drive to the same server? If a drive is mapped from the LAN to a server in the DMZ, will Windows Explorer try to verify the directory and attempt a logon, each time they open "My Computer" ?
Any ideas or suggestions are appreciated.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Check the event logs on the DC for failed logon attempts for the users being locked out. The event log will give you a logon type number - this will help you identify the type of logon that is failing.
See here for the type codes: http://www.windowsecurity.
For example - if you see a lot of failed logons with type 3, it's likely that it's bad credentials being use to map to a shared drive. It's worth checking cached credentials on the users' machines (Control Panel | User Accounts | Advanced | Manage passwords) - you can clear the cache if you think it's holding bad credentials.
In answer to your question about the mappings, yes, each time you try to connect to a share, a logon is attempted. Depending on how the drive is mapped originally, you'll either be using the credentials of the currently logged on user, or alternate credentials can be specified when the drive is originally mapped - if this is the case it could be that these are now out of date.
I don't think the fact that they are using RDP will have any bearing on why it's failing though...
See here for the type codes: http://www.windowsecurity.
For example - if you see a lot of failed logons with type 3, it's likely that it's bad credentials being use to map to a shared drive. It's worth checking cached credentials on the users' machines (Control Panel | User Accounts | Advanced | Manage passwords) - you can clear the cache if you think it's holding bad credentials.
In answer to your question about the mappings, yes, each time you try to connect to a share, a logon is attempted. Depending on how the drive is mapped originally, you'll either be using the credentials of the currently logged on user, or alternate credentials can be specified when the drive is originally mapped - if this is the case it could be that these are now out of date.
I don't think the fact that they are using RDP will have any bearing on why it's failing though...
http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en