[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 10167
  • Last Modified:

Active directory account keeps getting locked out after I changed my password

enterprise domain has 30 day password life. I changed password yesterday. every 30 minutes or so I am getting locked out(windows 7 computer, server2003 domain controller, server 2008r2 member servers).  My password in not used for any service account.  I have checked as many servers as I can but I do not see me being logged in.  Is there any easy way to determine where my account is logged in?  This is driving me crazy.

Thank you,
0
BUCKBERG
Asked:
BUCKBERG
4 Solutions
 
Gabriel CliftonCommented:
This could be something like a scheduled task or wireless on your phone, anything that might still have your old password stored in it for authentication.
0
 
BrandonProject Manager, IT Systems and Software DesignCommented:
I agree with PantherTech. I had a user change their desktop password yesterday but did not update their iPad at home. Every 30 minutes when the iPad tried to fetch it would cause her account to lock.

I simply removed the device from her email profile and forced her to resync today.
0
 
Rob WilliamsCommented:
Another is mapped drives that are saved with credentials and not updated.
0
 
Ricardo MartínezInformation SecurityCommented:
I often have that problem with the users in my domain cause they have their emails configured on their iPhone or Android phone, check for any of those devices, or you can also track with your firewall the traffic from your user (if you have a firewall authenticated with your domain).
0
 
Daniel BlackmoreInfrastructure EngineerCommented:
You will be able to see the events in the Event Viewer why your account is being locked out. I believe it is Event ID 644. Make sure that your Security Audit is set to Success/Failure though to see these errors inside the DC's event log.

You will see something like Caller Computer Name or similar which is the device that is causing your account to lock.

Additional, Event ID 529 which is a failed logon attempt should list everywhere that has the wrong credentials saved.
0

Featured Post

SMB Security Just Got a Layer Stronger

WatchGuard acquires Percipient Networks to extend protection to the DNS layer, further increasing the value of Total Security Suite.  Learn more about what this means for you and how you can improve your security with WatchGuard today!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now