Solved

User Account locks out randomly

Posted on 2014-11-04
8
91 Views
Last Modified: 2015-04-05
Experts!

I'm banging my head against a wall with this one.  I have a user account, that is getting locked out at random.  I have no idea what else to try.  We've verified his password, and its correct.  User ID is correct.  He is not using his login to run services anywhere.  We have checked every server to see if he has an RDP session stuck somewhere, and everything is cleared.  He is not logged into anyone else's machines that we know of.  He uses a tablet for email as well, but the tablet has the correct login info, as does his phone.  We've cleared his desktop of all cached and stored credentials.

We've ran scripts against the entire network to verify his user ID doesn't show up anywhere as active, yet, the account still continues to throw bad passwords at random DC's.  Every minute to 10 minutes, we see another bad hit against a DC, sometimes multiple DC's.  What else can we check that we haven't already done?
0
Comment
Question by:cocosyseng
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 20

Expert Comment

by:Russ Suter
ID: 40422869
Is he using any kind of VPN or credentials to access another network service? I've seen this happen in those cases.
0
 
LVL 33

Expert Comment

by:it_saige
ID: 40422870

1. Download the Account Lockout Status tools from Microsoft

http://www.microsoft.com/en-gb/download/details.aspx?id=15201

2. Run 'LockoutStatus.exe

Run the .msi to extract the files then run the LockoutStatus.exe tool

3. Choose 'Select Target' from the File Menu

Enter the user's account name as the target.
Add in the Administrator level credentials then hit OK.

4. Check the results

The LockoutStatus tool will show the status of the account on the domain DCs including the DCs which registered the account as locked and, crucially, which DCs recorded a bad password (the 'Bad Pwd Count' column).

The DCs most likely to give the result you need are those reporting one or more bad passwords as listed in the 'Bad Pwd Count' column.

5. Check the Security log on one of the listed DCs

In the Security Log of one of the domain controllers which show the account as locked, look for (the Filter option will help a lot here) Event ID 4771 on Server 2008 or Event ID 529 on Server 2003 containing the target username.

Specifically you need the log entries which show Failure code 0x18.

6. Note down the client IP address

This is the address of the machine that reported, or holds, the bad password.

7. Look for more 4771/529 events

In the Security Log of the client IP address machine look for more 4771/529 events with 0x18 Failure Codes and trace back to the listed Client IP Address.

Essentially you need to repeat steps 5 to 7 until you get to a more likely culprit (most likely a PC or a mobile device).

8. Identify the type of device issuing the bad password

If it's a PC then running PING-a <IP_Address> will give you the host name. At which point you can remind the user about them using this PC recently and how they really ought to log off when they're done.

If PING-a doesn't return a Host Name, lookup the MAC Address for the leased IP address in the DHCP Management.

9. Lookup the MAC Address Vendor

Enter the first three bytes of the MAC address in to http://www.macvendorlookup.com (other, similar web sites are available).

These instructions were taken from: http://community.spiceworks.com/how_to/show/48758-trace-the-source-of-a-bad-password-and-account-lockout-in-ad

-saige-
0
 

Author Comment

by:cocosyseng
ID: 40422909
I've been using this utility to monitor the bad password hits.  I just went through it with my team member, and we're not seeing any of these events in the event viewer for any of the DC's in recent periods.
0
 

Author Comment

by:cocosyseng
ID: 40422911
As far as the VPN goes, no, he is not connected to it...
0
Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

 
LVL 10

Expert Comment

by:Maclean
ID: 40422991
I usually utilize Netwrix Lockout Examiner (No advertisement btw, there might be similar tools)
The free version generally gives enough information regarding the source of the lockouts, and in my experience works better than the MS Lockout tools (Could be that I am not adapt at using the lockout tools to their full functionality of course).

http://www.netwrix.com/account_lockout_examiner.html
0
 
LVL 33

Expert Comment

by:it_saige
ID: 40423014
It could also be that you audit settings are too low to show the above events.  It wouldn't hurt to try the tool Maclean recommended.  If that doesn't work we can visit the audit settings.

-saige-
0
 
LVL 10

Accepted Solution

by:
Maclean earned 500 total points
ID: 40423032
On that note from it saige. Do indeed read the small manual which comes with the netwrix tool if you decide to try it.
It tells you which audit settings are required, and how to set this via GPO. Hope it helps.
0
 

Author Closing Comment

by:cocosyseng
ID: 40707420
We got to the bottom of this.  Cached credentials again...
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now