Improve company productivity with a Business Account.Sign Up


Account AD lockout on

Posted on 2013-06-25
Medium Priority
Last Modified: 2014-09-10
We have a user who using smart phone using activesync to sync company email. We are running Exchange 2007.

User change the AD password recently and didn't the new password on device. User reported that whenever device sync the email this will cause the password on AD locked.

The Wintel who working on this issue, informed us this AD lockout was due to Exchange CAS server.

They provided the event ID:

A user account was locked out.

                Security ID:                          SYSTEM
                Account Name:                   DC09$
                Account Domain:                                Contoso
                Logon ID:                              0x3e7

Account That Was Locked Out:
                Security ID:                          Contoso\sani
                Account Name:                   sani

Additional Information:
                Caller Computer Name:    ExchangeCA02

Please advice if issue AD lock out due to ExchangeCA02
Question by:suriyaehnop
  • 4
  • 4
  • 2
  • +3
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39274111
I don't under what you are actually asking.
If the user changes their password, but doesn't change the password in the phone then it is going to lock out the account. The account lockout will come from Exchange because that is where the authentication is happening. You get a small window where the old password works, but then the user needs to change the password entry on the device.


Expert Comment

ID: 39274256

Take back-up and wipe the device(smart phone) (i mean un-install active sync). Then configure active sync in the smart phone. It will work, the lockout issue won't occur again if the source is your smart phone active sync connection.

You can also clear cache in your workstation(may be some cached password stored in workstation can cause this issue). In the Log it is given that through CAS server it's getting locked also better to check for any session exist in CAS server with the user ID.

LVL 24

Expert Comment

ID: 39274404
You need to change password on device too.Change the password in smart phone  and you should be looking good.

There may be many other causes for account locked out.
•user's account in stored user name and passwords
•user's account tied to persistent mapped drive
•user's account as a service account
•user's account used as an IIS application pool identity
•user's account tied to a scheduled task
•un-suspending a virtual machine after a user's pw as changed

For more refer KB article:

Troubleshooting account lockout the Microsoft PSS way:
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why


Expert Comment

ID: 39274432

Check this
Exchange 2007 ActiveSync policy locks phones


Exchange 2007 CAS AD account lockouts

Hope that helps :)
LVL 19

Author Comment

ID: 39276675
Dear All,

I have password policy in AD, whereby any failed attempt more than 3 times, the password will lockout.

Let say password had changed the password due to password age requirement. User is able access laptop/map drive/outlook.

I understand the activesync phone will authenticate with server to sync the email but let say 1st attempt to sync the mail, it should be failed due to password changed.

How frequent the phone will authenticate with server to sync the phone?
LVL 19

Author Comment

ID: 39277071

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          6/26/2013 11:20:03 AM
Event ID:      4625
Task Category: Logon
Level:         Information
Keywords:      Audit Failure
User:          N/A
An account failed to log on.

	Security ID:		SYSTEM
	Account Name:		EXCHCA01$
	Account Domain:		site1
	Logon ID:		0x3e7

Logon Type:			8

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		SANI
	Account Domain:		site1

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:
	Caller Process ID:	0xc28
	Caller Process Name:	C:\Windows\System32\inetsrv\w3wp.exe

Network Information:
	Workstation Name:	EXCHCA01
	Source Network Address:
	Source Port:		28210

Detailed Authentication Information:
	Logon Process:		Advapi  
	Authentication Package:	Negotiate
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Event Xml:
<Event xmlns="">
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <TimeCreated SystemTime="2013-06-26T03:20:03.097Z" />
    <Correlation />
    <Execution ProcessID="652" ThreadID="4304" />
    <Security />
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">EXCHCA01$</Data>
    <Data Name="SubjectDomainName">site1</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="TargetUserSid">S-1-0-0</Data>
    <Data Name="TargetUserName">SANI</Data>
    <Data Name="TargetDomainName">site1</Data>
    <Data Name="Status">0xc000006d</Data>
    <Data Name="FailureReason">%%2313</Data>
    <Data Name="SubStatus">0xc000006a</Data>
    <Data Name="LogonType">8</Data>
    <Data Name="LogonProcessName">Advapi  </Data>
    <Data Name="AuthenticationPackageName">Negotiate</Data>
    <Data Name="WorkstationName">EXCHCA01</Data>
    <Data Name="TransmittedServices">-</Data>
    <Data Name="LmPackageName">-</Data>
    <Data Name="KeyLength">0</Data>
    <Data Name="ProcessId">0xc28</Data>
    <Data Name="ProcessName">C:\Windows\System32\inetsrv\w3wp.exe</Data>
    <Data Name="IpAddress"></Data>
    <Data Name="IpPort">28210</Data>

Open in new window is a Load Balancing Hardware for Exchange Client Access
LVL 24

Accepted Solution

Sandeshdubey earned 750 total points
ID: 39277614
If the phone devices is on each time it sync with exchange it will look for authentication.If the invalid attempt passed for x count as mentioned in GPO the account will be locked. The attempts are coming from:
LVL 63

Assisted Solution

by:Simon Butler (Sembee)
Simon Butler (Sembee) earned 750 total points
ID: 39277650
The old password can continue to work for some time after it has been changed, because ActiveSync maintains an extended session.

The behaviour is outlined in this KB article:

LVL 19

Author Comment

ID: 39313123
The activesync on exchange server was disabled for a week however when we check on u_ex130710.log (today log), it show that there is incoming activesync from SAMSUNG phone. User didn't use this phone anymore(don't know where the phone is :) )

2013-07-10 00:05:03 OPTIONS /Microsoft-Server-ActiveSync/default.eas Cmd=OPTIONS&User=Contoso%5Csani&DeviceId=SEC1851C45AFC9B9&DeviceType=SAMSUNGGTN7105 443 Contoso\sani SAMSUNG-GT-N7105/100.40102 401 1 1909 0

How do I can stop this.
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39313612
If the user doesn't have the phone, send a wipe command.

LVL 19

Author Comment

ID: 39313785
Clear-ActiveSyncDevice failed:

[PS] C:\>Clear-ActiveSyncDevice -Identity sani -WhatIf
Clear-ActiveSyncDevice : Cannot bind parameter 'Identity'. Cannot convert value "imtckm" to type "Microsoft.Exchange.Ma
nagement.Tasks.MobileDeviceIdParameter". Error: "sani is not a valid identity string for the mobile device. Call the
Get-ActiveSyncDeviceStatistics cmdlet by providing the -Mailbox property along with the user name. Example: Get-ActiveS
yncDeviceStatistics -Mailbox [user name]
Parameter name: deviceIdentity"
At line:1 char:33
+ Clear-ActiveSyncDevice -Identity  <<<< sani -WhatIf

Shall I enabled the Activesync features on Sani's mailbox? since I disabled it since a week ago
LVL 63

Expert Comment

by:Simon Butler (Sembee)
ID: 39313969
You will probably need to in order to use ActiveSync commandlets.


Expert Comment

ID: 40314217
I also have a similar problem and spend a lot of tije for finding root cause. You need to check the authentication log to the CAS server (Edge server) under path below if you want to know the root cause.

C:\Program Files\Microsoft\Exchange Server\TransportRoles\Logs\ProtocolLog\SmtpReceive

To solve the problem quickly, what you can try is change the username, ex: peter, change to peter222 at Active Directory.  User also need to update the login ID for his machine and device after you change.

I believe the user won't get "locked out" issue again.

Hope this can help you.

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

A method of moving multiple mailboxes (in bulk) to another database in an Exchange 2010/2013/2016 environment...
Migrating Exchange data from one Exchange Server to another server is complicated. Though Exchange administrators can try manual methods to migrate their data from one version of Exchange to another, these manual methods are not that reliable. That…
This video shows how to quickly and easily deploy an email signature for all users in Office 365 and prevent it from being added to replies and forwards. (the resulting signature is applied on the server level in Exchange Online) The email signat…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

601 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question