Account is keep locking out for a user

You can review the event logs on your DC and try to find out where the bad authentication attempts are coming from. It's typically a network drive mapped with old invalid credentials.

Only thing I can get in DC is event ID 644 for account locked out in Win 2003 server. I have checked her drives as well and I am sure there isn't any network drive mapped to it.

On your DCs, do you have auditing enabled for Audit account logon events.

gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy

Yes we have.

http://technet.microsoft.com/en-us/library/cc776964(v=ws.10).aspx

http://www.microsoft.com/en-us/download/details.aspx?id=18465

Look for event ID 529 for that particular user. You should also see the coinciding computer name where the attempt was made from.

Hi jerseysam

- I am using account lock out tool but not much help from this.
- Even I gave user new laptop and problem still happening

Looking like creating new profile for him then?

I guess providing new laptop create new profile itsself locally.

Onlything I hate to do is changing user login name.

Yes sorry, i mean new profile on server.

Its a pain but if you tried new computer then it must be his profile is corrupt.

Renaming the login name is not really a good fix. If there are cached credentials set somewhere you will still be bombarded on your event logs.

I already asked about the policies above jerseysam.

Hi motnahp00

I didn't find any event id 529.

I came across this little gem recently. We had a user that was getting locked just about every day. It would usually occur at logon or sometime shortly thereafter (timing was never consistent).

We used the lockout tools to determine that the lockout was coming from a desktop that she had never used. It turned out that the user naming convention y0000000 was part of the issue. The user on the machine that was locking out the account had transposed two numbers to match the locked out user account. It had gotten cached so when the user on the lockout machine logged in the other account would get locked out. We opened the Credential Store and deleted the offending entry.

Fun!