Solved

AD accounts not getting locked out properly ID 4771

Posted on 2012-12-27
8
1,043 Views
Last Modified: 2013-07-19
Hello,

I'm receiving many event ID's for 4771 on several domain controllers where I'm getting the below information with many authentication failures but the user accounts are not getting locked out when the default domain policy is set to lockout after 3 unsuccessful attempts. Any thoughts? Thanks


4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Thu Dec 27 20:26:01 2012,No User,Kerberos pre-authentication failed.    Account Information:   Security ID:  S-1-5-21-2094812614-1962491401-1202159320-115256   Account Name:  bvn0412    Service Information:   Service Name:  krbtgt/domain.COM    Network Information:   Client Address:  ::ffff:10.12.104.105   Client Port:  62426    Additional Information:   Ticket Options:  0x40810010   Failure Code:  0x18   Pre-Authentication Type: 2    Certificate Information:   Certificate Issuer Name:     Certificate Serial Number:     Certificate Thumbprint:      Certificate information is only provided if a certificate was used for pre-authentication.    Pre-authentication types, ticket options and failure codes are defined in RFC 4120.    If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
0
Comment
Question by:jacksonwsa
  • 4
  • 2
  • 2
8 Comments
 
LVL 15

Expert Comment

by:alienvoice
ID: 38725867
Over what time period are these failures occuring?

Are your default settings set to a short grace period?
0
 

Author Comment

by:jacksonwsa
ID: 38725875
I'm seeing like 8 failures in a day on this first account I'm looking at. Here is our default domain policy specifically the password piece.

Policy Setting
Enforce password history 5 passwords remembered
Maximum password age 45 days
Minimum password age 1 days
Minimum password length 8 characters
Password must meet complexity requirements Enabled
Store passwords using reversible encryption Disabled

Account Policies/Account Lockout Policyhide
Policy Setting
Account lockout duration 10080 minutes
Account lockout threshold 3 invalid logon attempts
Reset account lockout counter after 4320 minutes

Account Policies/Kerberos Policyhide
Policy Setting
Enforce user logon restrictions Enabled
Maximum lifetime for service ticket 600 minutes
Maximum lifetime for user ticket 10 hours
Maximum lifetime for user ticket renewal 7 days
Maximum tolerance for computer clock synchronization 5 minutes
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 38725879
What is your Reset Account Lockout Counter After setting?

Go through this as well to make sure all settings are set correctly

http://technet.microsoft.com/en-us/library/cc781491(v=ws.10).aspx

Run gpupdate on client

Run gpresult see if the policy is applying or not to the users
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 

Author Comment

by:jacksonwsa
ID: 38725883
I confirmed the policy is applying to two of the users
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 38725889
Alright check those settings
0
 
LVL 15

Accepted Solution

by:
alienvoice earned 500 total points
ID: 38725896
Check your 'Reset account Lockout Counter After' setting. This determines how many minutes can elapse after each failed attempt. Your 8 attempts per day may be occuring far enough apart not to trigger the lockout.

http://technet.microsoft.com/en-us/library/cc784599%28v=ws.10%29.aspx
0
 

Author Comment

by:jacksonwsa
ID: 38757651
I've dug into the logs and I think I'm making progress on this. Thanks for your help
0
 

Author Comment

by:jacksonwsa
ID: 39339307
I've requested that this question be closed as follows:

Accepted answer: 0 points for jacksonwsa's comment #a38757651

for the following reason:

This was never resolved
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question