I have a user running a Mac and his account is getting locked out constantly. He claims that nothing is using old credentials and that he deleted his keypass. however, every couple days we get this in the domain controllers:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: <user name>
Source Workstation: \\workstation
Error Code: 0xC000006A
Normally i would look at the source workstation area as it would tell me an IP address or valid computername. however, \\workstation never shows on our DNS or DHCP logs. and the microsoft authentication package v1.0 seems to be very generic from the searching i've done.
ive been using eventcoombt.exe and lockottstatus.exe to try and troubleshoot but i dont know where else to look. can install anything on this users mac or the DC's to get more detail or anything?