Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 990
  • Last Modified:

Account locked out, cannot change

I have one of our nurseries who cannot access their account, OWA, Intranet etc.
The account says:
"this account is currently locked out on this active directory domain controller"
I cannot seem to bypass this. I've ticked and applied to no avail.
I've changed the password.
The timeout appears to be 10 minutes and we have certainly passed that!
Any help please.
It is not just a case of ticking the box, I have tried this many times.
0
jasonbournecia
Asked:
jasonbournecia
  • 6
  • 6
1 Solution
 
Alan HardistyCommented:
The problem may be that as you are clearing the account - their computer is retrying the username / password and it is locking it out again.

Can you ask them to shut down any programs on their computer that would be using the account username / password or even shut the computer down until you can reset the account, then see if the account keeps locking it out.

You may also be the victim of a hacker trying to hack into the account remotely, so please check your Security Logs to see what the source of the account lockouts are.
0
 
jasonbourneciaAuthor Commented:
Hi alanhardisty, re the first bit, this is the first thing I got them to do; although I din't get them to restart, I got them to close IE and Outlook.
I will check the logs.
0
 
Alan HardistyCommented:
Thanks - will wait for your feedback.
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
jasonbourneciaAuthor Commented:
Out of my depth here. Lots of Securtiy Kerberos erro messages in 'System.
I think I need to call our support people again.
0
 
Alan HardistyCommented:
Filter by Invalid Logins. Right-Click on the Security Event Log, choose View> Filter.. Unselect all Event Types apart from Failure audit.

Then look at the failures and post the error from one or two Login Failure events please.
0
 
jasonbourneciaAuthor Commented:
I was able to filter the 'System' log for the specific user, there were no errors for that user in Securtiy. Under System, I got this:
"The SAM database was unable to lockout the account of myuser due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above."
I have reset their password this morning. Is it worth doing this again!?
0
 
Alan HardistyCommented:
Can you please look for the Account Locked error and then look for a couple of entries prior to the lockout and post the error from those events please.  They might give us a clue.
0
 
jasonbourneciaAuthor Commented:
Sorry Alan, in SBS2008, I cannot see the filtering quite as you say, hence why I filtered by the user's name.
If I go into windows logs, then right click security, there is no filter under 'Views' But, you can right click and 'filter current log', but I could not see how to filter by lockout.
0
 
Alan HardistyCommented:
Sorry - Please filter by Audit Failures (Keywords) and then look at the details of the error.
0
 
jasonbourneciaAuthor Commented:
Okay, done.
Obvioulsy I've changed the username and domain, but I will tell you one obvious issue, the domain name below user name was the name of the local PC. It looks like the user forgot to put our domain name then backslash in front of their username, so Windows 7 their end inserted the local workgroup name.
But, even so, I cannot release the locked user.
error.txt
0
 
Alan HardistyCommented:
Okay - so it seems to be the workstation that is causing the issues.  Is it switched off yet?
0
 
jasonbourneciaAuthor Commented:
Well, that's me suitably embarrassed!!!
Just disconnecting wasn't enough.
I've shut down their PCs and the message has gone :)
Thanks for your help.
I guess that somehow there was still a hook to the remote IP.
Their PCs are not inside the domain, so I thought just logging off Intranet and email would have been enough.
I overlooked the simple thing. Typical me.
Thanks again Alan.
John
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

  • 6
  • 6
Tackle projects and never again get stuck behind a technical roadblock.
Join Now