?
Solved

Active Directory Auto-locks Accounts

Posted on 2011-03-25
6
Medium Priority
?
972 Views
Last Modified: 2012-05-11
Points of my Scenario:
1. I am admin of a Windows Server 2003 domain
2. Over the past three days, user accounts in Active Directory have been randomly locking (& repeatedly)
3. I don't think users are lying about exceeding the "Account lockout threshold" - since this is happening to multiple, unrelated users at the same time.
QUESTION: How can I determine the cause and resolution for this strange phenomenon?
0
Comment
Question by:waforbes100
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 22

Assisted Solution

by:Joseph Moody
Joseph Moody earned 320 total points
ID: 35215135
0
 
LVL 3

Assisted Solution

by:Frank_Alphaserveit
Frank_Alphaserveit earned 220 total points
ID: 35215249
this is most likely due to those accounts being used in services or sessions with expired/cached passwords.
0
 
LVL 12

Expert Comment

by:nsx106052
ID: 35215296
I would check through the security logs on the domain controllers for failed log in attempts. From there you can pin point the location.  Then investigate the machine to see if it was invalid logins, stale passwords or a scheduled task.  
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 260 total points
ID: 35215370
You can look at this good blog entry that has links to some Microsoft tools and other suggestions

http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx

However, if it is a bunch of random accounts in AD I'd look for a malware/virus...specifically conficker which has been a big culprit the last few years when it is random.

If it was a service it would just be a few accounts not a bunch of them like this.

Thanks

Mike
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 35215372
0
 
LVL 44

Accepted Solution

by:
Amit earned 1200 total points
ID: 35215715
Download Account lock out tool from MS
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Use EventComb and run it agains your DC. Select Security and Failure options. Enter the user name in the text box and hit search. It will create a text file and you can find from which machine it is getting locked out. Later run aloinfo.exe to on the machine from where it is getting locked out. This will tell you if any process or task is configure with that account.

Finally, if you are unable to find the root cause. Just goto ADUC>Find that user>Click on Account Tab>In front of account name append 1

This will stop any further lockout issue for this user.
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question