Solved

User Account Automatically locks out in AD on Windows 2003 server

Posted on 2009-07-16
7
588 Views
Last Modified: 2012-05-07
User Account Automatically locks out in AD on Windows 2003 server. This has happened a couple of times. Is there any diagnostics or Fault finding that can be done ?
Can we ascertain whic Pc Is using that user account to log on etc...
Is there any thing that one can do to stop it and to go the bottome of the problem.

thx
adam
0
Comment
Question by:adam_kan2000
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 7

Accepted Solution

by:
kumarnirmal earned 125 total points
ID: 24868255
Hi,

This issue might be cause the activity of conflicker worm on your network , you can identified the machines causing account lock from the failure logs on the security logs.

Apply KB958644 & KB890830 and the restart the computer then run "c:\windows\system32\mrt.exe /F:Y to remove conflicker worm.
0
 
LVL 5

Expert Comment

by:ncomper
ID: 24868273
Does this happen when logging into different machines?

Also is the account set to  expire at any point?
0
 
LVL 7

Expert Comment

by:kumarnirmal
ID: 24868321
the account lock out is happening for a particular user or randomly the accounts get locked ?
 
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:adam_kan2000
ID: 24868801
It is only happening for one user and there is not a lot in the security logs ?
0
 
LVL 4

Assisted Solution

by:DarrenJL
DarrenJL earned 125 total points
ID: 24869649
It does sound a lot like the Conficker worm (http://support.microsoft.com/kb/962007) but it could also be something else.

We use a proxy server to protect our users from the web and occasionally this locks certain users out. One user (Web development) uses Safari as one of their web browsers and that tries multiple times to connect to the web through the proxy server, after the 10th attempt it locks the users account and requires a member of IT to unlock it again.

Our Proxy server is connected via LDAP to our AD infrastructure.

Darren
0
 

Author Comment

by:adam_kan2000
ID: 24877467
Is there any diagnostics work that can be done on the AD

Thx
Adam
0
 
LVL 4

Expert Comment

by:DarrenJL
ID: 24877525
You can enable advanced ldownloading the Account Lockout and Management Tools

http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Darren
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I guess it is not common knowledge to most Wintel engineers/administrators: If you have an SNMP-based monitoring system in your environment (and it's common to have SNMP or Syslog) it's reasonably easy to enable monitoring of the Windows Event logs,…
Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question