Polyfil
asked on
User lockout in Active Directory Windows 2003
We have 2 users that get repeatedly locked out. One of them has the issue multiple times per week and sometimes twice in the same day. We have not been able to track it down. We are not sure what additional logging we should be doing to identify this. Most often the lockout occurs when this user is not accessing our network.
We have confirmed that all settings in their iPhone and iPad are correct. We have also deleted entries on the iPhone and iPad an recreated them. This is not the only user with iPhone and iPad in our organization.
We have confirmed that all settings in their iPhone and iPad are correct. We have also deleted entries on the iPhone and iPad an recreated them. This is not the only user with iPhone and iPad in our organization.
ASKER
Power Shell support is not available in Exchange 2003.
Alockoutstatus.exe can give you the details from which dc it is locking out and you can check for that perticular security log on that dc for source of bad passwords.
Enable account lockout policy, when the account gets locked an event will be triggered in the event viewer. This will help in determining what device is causing the issue
ASKER
We already have that set. The event we are seeing is only at the point of lockout. We don't see the bad password event that lead up to the lockout. We have downloaded the lock out status monitor and it isn't showing the events either.
I guess use last remedy, rename the account, it won't affect anything. Just goto Account tab and append 1 or whatever is your choice.
ASKER
Won't that affect the user profile on the desktop?
Look in the activesync server logs. %windows%\system32\LogFile
you can also refer to this locked out account ipad/iphone
you can also refer to this locked out account ipad/iphone
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
http://www.microsoft.com/en-us/download/details.aspx?id=18465
More to read here
http://msexchangeguru.com/2012/03/08/ad-lockout/
normally, if non of this works, i just rename the account. Goto Account tab in AD and change it from user to user1 that is the last remedy.