Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Active Directory Auto-locks Accounts

Posted on 2011-03-25
6
Medium Priority
?
974 Views
Last Modified: 2012-05-11
Points of my Scenario:
1. I am admin of a Windows Server 2003 domain
2. Over the past three days, user accounts in Active Directory have been randomly locking (& repeatedly)
3. I don't think users are lying about exceeding the "Account lockout threshold" - since this is happening to multiple, unrelated users at the same time.
QUESTION: How can I determine the cause and resolution for this strange phenomenon?
0
Comment
Question by:waforbes100
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 22

Assisted Solution

by:Joseph Moody
Joseph Moody earned 320 total points
ID: 35215135
0
 
LVL 3

Assisted Solution

by:Frank_Alphaserveit
Frank_Alphaserveit earned 220 total points
ID: 35215249
this is most likely due to those accounts being used in services or sessions with expired/cached passwords.
0
 
LVL 12

Expert Comment

by:nsx106052
ID: 35215296
I would check through the security logs on the domain controllers for failed log in attempts. From there you can pin point the location.  Then investigate the machine to see if it was invalid logins, stale passwords or a scheduled task.  
0
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 260 total points
ID: 35215370
You can look at this good blog entry that has links to some Microsoft tools and other suggestions

http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx

However, if it is a bunch of random accounts in AD I'd look for a malware/virus...specifically conficker which has been a big culprit the last few years when it is random.

If it was a service it would just be a few accounts not a bunch of them like this.

Thanks

Mike
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 35215372
0
 
LVL 44

Accepted Solution

by:
Amit earned 1200 total points
ID: 35215715
Download Account lock out tool from MS
http://www.microsoft.com/downloads/en/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Use EventComb and run it agains your DC. Select Security and Failure options. Enter the user name in the text box and hit search. It will create a text file and you can find from which machine it is getting locked out. Later run aloinfo.exe to on the machine from where it is getting locked out. This will tell you if any process or task is configure with that account.

Finally, if you are unable to find the root cause. Just goto ADUC>Find that user>Click on Account Tab>In front of account name append 1

This will stop any further lockout issue for this user.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Let's recap what we learned from yesterday's Skyport Systems webinar.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Suggested Courses

596 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question