• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 380
  • Last Modified:

How to find why domain user's account keeps locking out?

I have a DBA who's domain account keeps locking out.  What is the quickest way to find this culprit?  I have had them check all of their automated task scheduled jobs to make sure they are using the correct credentials but it is still locking out.  Is this information logged in event viewer on the DC to find the culprit?  I don't have access to the DC but I can have someone check this out.  Thanks for your help, this user is driving me nuts...
0
gloyola1
Asked:
gloyola1
1 Solution
 
DeleteCommented:
Download the Account Lockout Tool from Microsoft and run it against your Domain Controllers.  You can download the tool here: http://www.microsoft.com/en-us/download/details.aspx?id=18465 

The tool will let you know what Domain Controller the account locked out against.  Once you know the Domain Controller look in the Security log of that Domain Controller for the lock out event which I believe is EventID 644 (or you can simply search for the username of the account being locked out).  

Once you find the event, it will tell you what system is locking out the account.  Next you will need to go to that system and investigate logs, processes, applications, scheduled tasks, etc... to find where the bad password is stored.
0
 
gloyola1Author Commented:
Great tool.  Thanks
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now