asked on

Account AD lockout on

We have a user who using smart phone using activesync to sync company email. We are running Exchange 2007.

User change the AD password recently and didn't the new password on device. User reported that whenever device sync the email this will cause the password on AD locked.

The Wintel who working on this issue, informed us this AD lockout was due to Exchange CAS server.

They provided the event ID:

A user account was locked out.

Subject:
Security ID: SYSTEM
Account Name: DC09$
Account Domain: Contoso
Logon ID: 0x3e7

Account That Was Locked Out:
Security ID: Contoso\sani
Account Name: sani

Additional Information:
Caller Computer Name: ExchangeCA02

Please advice if issue AD lock out due to ExchangeCA02

Simon Butler (Sembee)

I don't under what you are actually asking.
If the user changes their password, but doesn't change the password in the phone then it is going to lock out the account. The account lockout will come from Exchange because that is where the authentication is happening. You get a small window where the old password works, but then the user needs to change the password entry on the device.

Simon.

vin_shooter

Hi,

Take back-up and wipe the device(smart phone) (i mean un-install active sync). Then configure active sync in the smart phone. It will work, the lockout issue won't occur again if the source is your smart phone active sync connection.

You can also clear cache in your workstation(may be some cached password stored in workstation can cause this issue). In the Log it is given that through CAS server it's getting locked also better to check for any session exist in CAS server with the user ID.

Thanks..,:)

Sandesh Dubey

You need to change password on device too.Change the password in smart phone and you should be looking good.

There may be many other causes for account locked out.
•user's account in stored user name and passwords
•user's account tied to persistent mapped drive
•user's account as a service account
•user's account used as an IIS application pool identity
•user's account tied to a scheduled task
•un-suspending a virtual machine after a user's pw as changed
•A SMARTPHONE!!!

For more refer KB article:http://technet.microsoft.com/en-us/library/cc773155(WS.10).aspx

Troubleshooting account lockout the Microsoft PSS way:
http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx

VirastaR

Hi,

Check this

http://www.petri.co.il/forums/showthread.php?t=21486
Exchange 2007 ActiveSync policy locks phones

and

Exchange 2007 CAS AD account lockouts
http://www.networksteve.com/exchange/topic.php/Exchange_2007_CAS_AD_account_lockouts/?TopicId=24814&Posts=0

Hope that helps :)

suriyaehnop

ASKER

Dear All,

I have password policy in AD, whereby any failed attempt more than 3 times, the password will lockout.

Let say password had changed the password due to password age requirement. User is able access laptop/map drive/outlook.

I understand the activesync phone will authenticate with server to sync the email but let say 1st attempt to sync the mail, it should be failed due to password changed.

How frequent the phone will authenticate with server to sync the phone?

suriyaehnop

ASKER

HERE IS FULL LOG:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          6/26/2013 11:20:03 AM
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      EXCHCA01.site1.CORP.contoso.com
Description:
An account failed to log on.

Subject:
	Security ID:		SYSTEM
	Account Name:		EXCHCA01$
	Account Domain:		site1
	Logon ID:		0x3e7

Logon Type:			8

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		SANI
	Account Domain:		site1

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:
	Caller Process ID:	0xc28
	Caller Process Name:	C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
	Workstation Name:	EXCHCA01
	Source Network Address:	200.44.173.196
	Source Port:		28210

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <EventID>4625</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12544</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2013-06-26T03:20:03.097Z" />
    <EventRecordID>577862646</EventRecordID>
    <Correlation />
    <Execution ProcessID="652" ThreadID="4304" />
    <Channel>Security</Channel>
    <Computer>EXCHCA01.site1.CORP.contoso.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">EXCHCA01$</Data>
    <Data Name="SubjectDomainName">site1</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">SANI</Data>
    <Data Name="TargetDomainName">site1</Data>
    <Data Name="Status">0xc000006d</Data>
    <Data Name="FailureReason">%%2313</Data>
    <Data Name="SubStatus">0xc000006a</Data>
    <Data Name="LogonType">8</Data>
    <Data Name="LogonProcessName">Advapi  </Data>
    <Data Name="AuthenticationPackageName">Negotiate</Data>
    <Data Name="WorkstationName">EXCHCA01</Data>
    <Data Name="TransmittedServices">-</Data>
    <Data Name="LmPackageName">-</Data>
    <Data Name="KeyLength">0</Data>
    <Data Name="ProcessId">0xc28</Data>
    <Data Name="ProcessName">C:\Windows\System32\inetsrv\w3wp.exe</Data>
    <Data Name="IpAddress">200.44.173.196</Data>
    <Data Name="IpPort">28210</Data>
  </EventData>
</Event>

Open in new window

200.44.173.196 is a Load Balancing Hardware for Exchange Client Access

ASKER CERTIFIED SOLUTION

Sandesh Dubey

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

SOLUTION

Simon Butler (Sembee)

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

suriyaehnop

ASKER

The activesync on exchange server was disabled for a week however when we check on u_ex130710.log (today log), it show that there is incoming activesync from SAMSUNG phone. User didn't use this phone anymore(don't know where the phone is :) )

2013-07-10 00:05:03 10.10.10.22 OPTIONS /Microsoft-Server-ActiveSync/default.eas Cmd=OPTIONS&User=Contoso%5Csani&DeviceId=SEC1851C45AFC9B9&DeviceType=SAMSUNGGTN7105 443 Contoso\sani 200.44.173.196 SAMSUNG-GT-N7105/100.40102 401 1 1909 0

How do I can stop this.

Simon Butler (Sembee)

If the user doesn't have the phone, send a wipe command.

Simon.

suriyaehnop

ASKER

Clear-ActiveSyncDevice failed:

[PS] C:\>Clear-ActiveSyncDevice -Identity sani -WhatIf
Clear-ActiveSyncDevice : Cannot bind parameter 'Identity'. Cannot convert value "imtckm" to type "Microsoft.Exchange.Ma
nagement.Tasks.MobileDeviceIdParameter". Error: "sani is not a valid identity string for the mobile device. Call the
Get-ActiveSyncDeviceStatistics cmdlet by providing the -Mailbox property along with the user name. Example: Get-ActiveS
yncDeviceStatistics -Mailbox [user name]
Parameter name: deviceIdentity"
At line:1 char:33
+ Clear-ActiveSyncDevice -Identity <<<< sani -WhatIf

Shall I enabled the Activesync features on Sani's mailbox? since I disabled it since a week ago

Simon Butler (Sembee)

You will probably need to in order to use ActiveSync commandlets.

Simon.

G2020

I also have a similar problem and spend a lot of tije for finding root cause. You need to check the authentication log to the CAS server (Edge server) under path below if you want to know the root cause.

C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\ProtocolLog\SmtpReceive

To solve the problem quickly, what you can try is change the username, ex: peter, change to peter222 at Active Directory. User also need to update the login ID for his machine and device after you change.

I believe the user won't get "locked out" issue again.

Hope this can help you.