Solved

Account locked out, cannot change

Posted on 2011-02-28
12
981 Views
Last Modified: 2012-06-27
I have one of our nurseries who cannot access their account, OWA, Intranet etc.
The account says:
"this account is currently locked out on this active directory domain controller"
I cannot seem to bypass this. I've ticked and applied to no avail.
I've changed the password.
The timeout appears to be 10 minutes and we have certainly passed that!
Any help please.
It is not just a case of ticking the box, I have tried this many times.
0
Comment
Question by:jasonbournecia
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 6
12 Comments
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34996428
The problem may be that as you are clearing the account - their computer is retrying the username / password and it is locking it out again.

Can you ask them to shut down any programs on their computer that would be using the account username / password or even shut the computer down until you can reset the account, then see if the account keeps locking it out.

You may also be the victim of a hacker trying to hack into the account remotely, so please check your Security Logs to see what the source of the account lockouts are.
0
 

Author Comment

by:jasonbournecia
ID: 34996650
Hi alanhardisty, re the first bit, this is the first thing I got them to do; although I din't get them to restart, I got them to close IE and Outlook.
I will check the logs.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34996657
Thanks - will wait for your feedback.
0
The Ultimate Checklist to Optimize Your Website

Websites are getting bigger and complicated by the day. Video, images, custom fonts are all great for showcasing your product/service. But the price to pay in terms of reduced page load times and ultimately, decreased sales, can lead to some difficult decisions about what to cut.

 

Author Comment

by:jasonbournecia
ID: 34996796
Out of my depth here. Lots of Securtiy Kerberos erro messages in 'System.
I think I need to call our support people again.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34996812
Filter by Invalid Logins. Right-Click on the Security Event Log, choose View> Filter.. Unselect all Event Types apart from Failure audit.

Then look at the failures and post the error from one or two Login Failure events please.
0
 

Author Comment

by:jasonbournecia
ID: 34996967
I was able to filter the 'System' log for the specific user, there were no errors for that user in Securtiy. Under System, I got this:
"The SAM database was unable to lockout the account of myuser due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above."
I have reset their password this morning. Is it worth doing this again!?
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34997078
Can you please look for the Account Locked error and then look for a couple of entries prior to the lockout and post the error from those events please.  They might give us a clue.
0
 

Author Comment

by:jasonbournecia
ID: 34997200
Sorry Alan, in SBS2008, I cannot see the filtering quite as you say, hence why I filtered by the user's name.
If I go into windows logs, then right click security, there is no filter under 'Views' But, you can right click and 'filter current log', but I could not see how to filter by lockout.
0
 
LVL 76

Expert Comment

by:Alan Hardisty
ID: 34997284
Sorry - Please filter by Audit Failures (Keywords) and then look at the details of the error.
0
 

Author Comment

by:jasonbournecia
ID: 34997702
Okay, done.
Obvioulsy I've changed the username and domain, but I will tell you one obvious issue, the domain name below user name was the name of the local PC. It looks like the user forgot to put our domain name then backslash in front of their username, so Windows 7 their end inserted the local workgroup name.
But, even so, I cannot release the locked user.
error.txt
0
 
LVL 76

Accepted Solution

by:
Alan Hardisty earned 500 total points
ID: 34997754
Okay - so it seems to be the workstation that is causing the issues.  Is it switched off yet?
0
 

Author Closing Comment

by:jasonbournecia
ID: 34998260
Well, that's me suitably embarrassed!!!
Just disconnecting wasn't enough.
I've shut down their PCs and the message has gone :)
Thanks for your help.
I guess that somehow there was still a hook to the remote IP.
Their PCs are not inside the domain, so I thought just logging off Intranet and email would have been enough.
I overlooked the simple thing. Typical me.
Thanks again Alan.
John
0

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows the method of using the Resultant Set of Policy Tool to locate Group Policy that applies a particular setting.
Active Directory security has been a hot topic of late, and for good reason. With 90% of the world’s organization using this system to manage access to all parts of their IT infrastructure, knowing how to protect against threats and keep vulnerabil…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

690 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question