Account is locking out constantly

9/6/2013

ASKER CERTIFIED SOLUTION

TunerML

9/6/2013

THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

9/6/2013

ASKER

No software is using the account that I know of. I used a lockout examiner and this is the information it gave me.
Capture.JPG

9/6/2013

Make sure you don't have a service on the server trying to run as that account. That is what it looks like to me. Something is trying to log into the account and is not getting in. You may also want to check you event logs for failed login attempts

9/6/2013

Check your Security log on the DC. It will tell you a lot of info. Filter by failed Audits and start to check the failures for your Admin account.

Things it could be .. services running under the Admin credentials, softwares doing the same, mail enabled software trying to send emails/alerts, Scheduled talks ...

9/6/2013

First figure out which machine(s) the failures are coming from.

9/6/2013

ASKER

Here is the security log info I found...help?
Capture2.JPG

9/6/2013

Failure code 0x18 is Pre-auth failure with bad password for kerberos.

What machine does the IP Address belong to?

9/6/2013

ASKER

our secondary domain controller.

9/6/2013

Check services on that DC and make sure nothing is running as the admin account.

9/6/2013

I would say you have something confi'd to run with the admin account credentials. Services, software, explicit mapped drives or printers, Scheduled task.

Check credential Manager also to see if there is anything in there

All on your second DC

9/6/2013

ASKER

Nothing in Credential Manager and no services running as that account. The server also has no mapped drives or printers.

9/6/2013

At this point I would personally be running Wireshark (or your preference of tool) to capture the packets to see what is passing the Admin Credentials