Barnardos_2LS
asked on
Active Directory Account Locked Out
A particular users account has begun to continually lock out (past month) no new software has been installed. The lockout can occur while user working on the PC/or while PC stationary .ie during lunch or up to 45 minutes after login out? Any ideas as to what could be causing this to occur?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
More specifically, in the lockout tools download that was mentioned earlier there is a tool called - LockoutStatus. This tool, will allow you to see what domain controller locked the user account. From there, you should log on to the domain controller and look at the security event logs. That should narrow down the issue.
The Lockout tool referenced by xxdcmast will help you determine which dc locked the account based on failed login attempts. It includes an event data gatherer which you would need to use to collect failed login security event id 528, 530
This will help you locate the system from which the requests are being generated.
Along the path of PenguinN, if you have terminal servers, the user might have an active session that was established prior to the user's recent password change outside that terminal session.
This will help you locate the system from which the requests are being generated.
Along the path of PenguinN, if you have terminal servers, the user might have an active session that was established prior to the user's recent password change outside that terminal session.
ASKER
We have already installed the lockoutstatus upon users PC.... please find attached the HODC1 lockout details...
Did you mean to attach, embed hofdc1 report of events?
ASKER
Yes as per the request from xxdcmast - ID37746920. Not sure if the events log is of any help though?
I do not see anything attached perhaps because of what I amusing, the event log should tell you the some of the request which you should thn heck for virus,etc.
Note a session established prior to a user changing their password in a different session or another computer would explain this issue because the original question has a token for their credential with the now incorrect password.
If the user must maintain that session, they must change/update their password within that session which will update the cached credentials.
Note a session established prior to a user changing their password in a different session or another computer would explain this issue because the original question has a token for their credential with the now incorrect password.
If the user must maintain that session, they must change/update their password within that session which will update the cached credentials.
ASKER
An open RDP session was discovered. Once this was closed the issue no longer occurred.
http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465