Solved

User accounts "locked"

Posted on 2009-04-03
3
374 Views
Last Modified: 2012-06-27
I have my LAN Domain, and my DMZ Domain separated via firewall. There is a terminal server in the DMZ, accessible via the Internet, and the LAN. When users in the LAN connect via RDP to the Terminal Server in the DMZ, they must use there user account in the DMZ, as there is no domain trust between LAN and DMZ domains. Users can also map a network drive from there LAN PC's to the server share in the DMZ, again, using there DMZ credentials to connect.

Problem:
LAN users that connect to the Terminal Server, are consistently finding that their user accounts are locked out. I have other users that use servers in the DMZ domain (Sharepoint), and none of them have this problem. Why are the Terminal Server user accounts being locked out so frequently?

Is it that the users are simply forgetting their passwords, or does it have something to do with the combination of using Remote Desktop, and mapping a network drive to the same server? If a drive is mapped from the LAN to a server in the DMZ, will Windows Explorer try to verify the directory and attempt a logon, each time they open "My Computer" ?

Any ideas or suggestions are appreciated.
0
Comment
Question by:mahjohn
3 Comments
 
LVL 9

Accepted Solution

by:
cmorffew earned 500 total points
ID: 24065390
0
 
LVL 14

Expert Comment

by:top_rung
ID: 24065418
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 24067543
Check the event logs on the DC for failed logon attempts for the users being locked out. The event log will give you a logon type number - this will help you identify the type of logon that is failing.
See here for the type codes: http://www.windowsecurity.com/articles/Logon-Types.html
For example - if you see a lot of failed logons with type 3, it's likely that it's bad credentials being use to map to a shared drive. It's worth checking cached credentials on the users' machines (Control Panel | User Accounts | Advanced | Manage passwords) - you can clear the cache if you think it's holding bad credentials.
In answer to your question about the mappings, yes, each time you try to connect to a share, a logon is attempted. Depending on how the drive is mapped originally, you'll either be using the credentials of the currently logged on user, or alternate credentials can be specified when the drive is originally mapped - if this is the case it could be that these are now out of date.
I don't think the fact that they are using RDP will have any bearing on why it's failing though...
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now