User Kicked out of Windows session and taken to login screen at same time every day.

stg-admin
stg-admin used Ask the Experts™
on
I have one user in our domain who, at exactly 5:00 every weekday, will be working in their windows session normally and then kicked out and taken to windows login screen. She tries to enter her password and it is rejected 3 times until she gets locked out. No pertinent information at that time in system or app event logs. No entries in AD User Profile. Issue only exists for one user so dont think that its a Server side issue. Trying to avoid reimaging the machine. Any ideas?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2011
Top Expert 2011

Commented:
Does it happen on another machine?

Author

Commented:
You mean logged in as her on another machine? I havent tested this but am pretty sure that if I re-created her user profile on the existing machine, issue would not be present.
Most Valuable Expert 2011
Top Expert 2011

Commented:
easy enough to simply rename the local copy, and create from scratch....... Or test another machine, same difference really....
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Commented:
You can open ADUC & search user,go to properties> Account tab> Logon Hours.

If logon hours is defined that might be the issue.

As its happening for single user this might be the culprit or in termianl server there is force discoonect option check for that.

 
One of the best link i came accross for troubleshooting Terminal server issues.

http://www.msterminalservices.org/faq/WindowsTerminalServices/?page=22

Author

Commented:
Logon hours are the first thing I checked. The user is not on termserver. Its a local laptop.
Awinish is correct, if this is happening to just that one particular user everyday, then someone had configured her logon hours to cut off at 1700. just edit their account in dsa.msc and click on the account tab, then click logon hours. select all the cells available in on the left and choose the radio button to logon permitted. have the user log off the machine and then back on, and tell her to check back in with you if it happens to her again.

Commented:
Have you checked any events in the event viewer of that time? You may get some events from any processes? May be any malware that does that on a specific time?

Most Valuable Expert 2011
Top Expert 2011

Commented:
Check the local laptop also for Local laptops, just in case you didnt check the LOCAL......

net user USERNAME

Author

Commented:
As far as events, there is nothing in events which indicates any issue.
I ran spybot and malwarebytes for malware which there are none on the machine.
Nothing in logon hours. Its all Blue for her account.
This is a strange issue... Im going to try to wipe out her profile, but looks to be some process which runs at same time.
Most Valuable Expert 2011
Top Expert 2011
Commented:
Any services/scheduled tasks running under her account?

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial