[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

Active Directory Account Locked Out

Posted on 2012-03-21
10
Medium Priority
?
363 Views
Last Modified: 2012-06-21
A particular users account has begun to continually lock out (past month) no new software has been installed. The lockout can occur while user working on the PC/or while PC stationary .ie during lunch or up to 45 minutes after login out? Any ideas as to what could be causing this to occur?
0
Comment
Question by:Barnardos_2LS
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
10 Comments
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 37746920
First thing first download lockout tools. This will let you see what time and on what DC the account is locking out from. Once you find that event post it here and we can tell you more of whats going on.

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465
0
 
LVL 8

Accepted Solution

by:
PenguinN earned 2000 total points
ID: 37746929
Is RDP open to the outside world? This can be an issue.
Also chck any remote devices connecting as the user.
0
 
LVL 2

Expert Comment

by:postechgeek
ID: 37746990
More specifically, in the lockout tools download that was mentioned earlier there is a tool called - LockoutStatus. This tool, will allow you to see what domain controller locked the user account. From there, you should log on to the domain controller and look at the security event logs. That should narrow down the issue.
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
LVL 80

Expert Comment

by:arnold
ID: 37747005
The Lockout tool referenced by xxdcmast will help you determine which dc locked the account based on failed login attempts. It includes an event data gatherer which you would need to use to collect failed login security event id 528, 530
This will help you locate the system from which the requests are being generated.

Along the path of PenguinN, if you have terminal servers, the user might have an active session that was established prior to the user's recent password change outside that terminal session.
0
 
LVL 1

Author Comment

by:Barnardos_2LS
ID: 37747418
We have already installed the lockoutstatus upon users PC.... please  find attached  the HODC1 lockout details...
0
 
LVL 80

Expert Comment

by:arnold
ID: 37747841
Did you mean to attach, embed hofdc1 report of events?
0
 
LVL 1

Author Comment

by:Barnardos_2LS
ID: 37748023
Yes as per the request from xxdcmast - ID37746920. Not sure if the events log is of any help though?
0
 
LVL 80

Expert Comment

by:arnold
ID: 37748132
I do not see anything attached perhaps because of what I amusing, the event log should tell you the some of the request which you should thn heck for virus,etc.
Note a session established prior to a user changing their password in a different session or another computer would explain this issue because the original question has a token for their credential with the now incorrect password.
If the user must maintain that session, they must change/update their password within that session which will update the cached credentials.
0
 
LVL 1

Author Closing Comment

by:Barnardos_2LS
ID: 37854836
An open RDP session was discovered. Once this was closed the issue no longer occurred.
0

Featured Post

Tech or Treat!

Submit an article about your scariest tech experience—and the solution—and you’ll be automatically entered to win one of 4 fantastic tech gadgets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If your system is showing symptoms of browser hijacks or 'google search redirects' check out my other article (http://rdsrc.us/u3GP7A) first and run the tool TDSSKiller (http://rdsrc.us/GDBBs4) to get rid of the infection. Once done, and if the …
Issue: Unstable cursor in Windows XP and Windows runs extremely slow in that any click will bring up the Hour glass (sometimes for several seconds before giving you what you want) . Troubleshooting Process and the FINAL FIX: This issue see…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question