Solved

Account locked out, cannot change

Posted on 2011-02-28
12
975 Views
Last Modified: 2012-06-27
I have one of our nurseries who cannot access their account, OWA, Intranet etc.
The account says:
"this account is currently locked out on this active directory domain controller"
I cannot seem to bypass this. I've ticked and applied to no avail.
I've changed the password.
The timeout appears to be 10 minutes and we have certainly passed that!
Any help please.
It is not just a case of ticking the box, I have tried this many times.
0
Comment
Question by:jasonbournecia
  • 6
  • 6
12 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34996428
The problem may be that as you are clearing the account - their computer is retrying the username / password and it is locking it out again.

Can you ask them to shut down any programs on their computer that would be using the account username / password or even shut the computer down until you can reset the account, then see if the account keeps locking it out.

You may also be the victim of a hacker trying to hack into the account remotely, so please check your Security Logs to see what the source of the account lockouts are.
0
 

Author Comment

by:jasonbournecia
ID: 34996650
Hi alanhardisty, re the first bit, this is the first thing I got them to do; although I din't get them to restart, I got them to close IE and Outlook.
I will check the logs.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34996657
Thanks - will wait for your feedback.
0
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:jasonbournecia
ID: 34996796
Out of my depth here. Lots of Securtiy Kerberos erro messages in 'System.
I think I need to call our support people again.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34996812
Filter by Invalid Logins. Right-Click on the Security Event Log, choose View> Filter.. Unselect all Event Types apart from Failure audit.

Then look at the failures and post the error from one or two Login Failure events please.
0
 

Author Comment

by:jasonbournecia
ID: 34996967
I was able to filter the 'System' log for the specific user, there were no errors for that user in Securtiy. Under System, I got this:
"The SAM database was unable to lockout the account of myuser due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above."
I have reset their password this morning. Is it worth doing this again!?
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34997078
Can you please look for the Account Locked error and then look for a couple of entries prior to the lockout and post the error from those events please.  They might give us a clue.
0
 

Author Comment

by:jasonbournecia
ID: 34997200
Sorry Alan, in SBS2008, I cannot see the filtering quite as you say, hence why I filtered by the user's name.
If I go into windows logs, then right click security, there is no filter under 'Views' But, you can right click and 'filter current log', but I could not see how to filter by lockout.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34997284
Sorry - Please filter by Audit Failures (Keywords) and then look at the details of the error.
0
 

Author Comment

by:jasonbournecia
ID: 34997702
Okay, done.
Obvioulsy I've changed the username and domain, but I will tell you one obvious issue, the domain name below user name was the name of the local PC. It looks like the user forgot to put our domain name then backslash in front of their username, so Windows 7 their end inserted the local workgroup name.
But, even so, I cannot release the locked user.
error.txt
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 500 total points
ID: 34997754
Okay - so it seems to be the workstation that is causing the issues.  Is it switched off yet?
0
 

Author Closing Comment

by:jasonbournecia
ID: 34998260
Well, that's me suitably embarrassed!!!
Just disconnecting wasn't enough.
I've shut down their PCs and the message has gone :)
Thanks for your help.
I guess that somehow there was still a hook to the remote IP.
Their PCs are not inside the domain, so I thought just logging off Intranet and email would have been enough.
I overlooked the simple thing. Typical me.
Thanks again Alan.
John
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question