User Account locks out randomly

Experts!

I'm banging my head against a wall with this one.  I have a user account, that is getting locked out at random.  I have no idea what else to try.  We've verified his password, and its correct.  User ID is correct.  He is not using his login to run services anywhere.  We have checked every server to see if he has an RDP session stuck somewhere, and everything is cleared.  He is not logged into anyone else's machines that we know of.  He uses a tablet for email as well, but the tablet has the correct login info, as does his phone.  We've cleared his desktop of all cached and stored credentials.

We've ran scripts against the entire network to verify his user ID doesn't show up anywhere as active, yet, the account still continues to throw bad passwords at random DC's.  Every minute to 10 minutes, we see another bad hit against a DC, sometimes multiple DC's.  What else can we check that we haven't already done?
cocosysengAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Russ SuterCommented:
Is he using any kind of VPN or credentials to access another network service? I've seen this happen in those cases.
0
it_saigeDeveloperCommented:

1. Download the Account Lockout Status tools from Microsoft

http://www.microsoft.com/en-gb/download/details.aspx?id=15201

2. Run 'LockoutStatus.exe

Run the .msi to extract the files then run the LockoutStatus.exe tool

3. Choose 'Select Target' from the File Menu

Enter the user's account name as the target.
Add in the Administrator level credentials then hit OK.

4. Check the results

The LockoutStatus tool will show the status of the account on the domain DCs including the DCs which registered the account as locked and, crucially, which DCs recorded a bad password (the 'Bad Pwd Count' column).

The DCs most likely to give the result you need are those reporting one or more bad passwords as listed in the 'Bad Pwd Count' column.

5. Check the Security log on one of the listed DCs

In the Security Log of one of the domain controllers which show the account as locked, look for (the Filter option will help a lot here) Event ID 4771 on Server 2008 or Event ID 529 on Server 2003 containing the target username.

Specifically you need the log entries which show Failure code 0x18.

6. Note down the client IP address

This is the address of the machine that reported, or holds, the bad password.

7. Look for more 4771/529 events

In the Security Log of the client IP address machine look for more 4771/529 events with 0x18 Failure Codes and trace back to the listed Client IP Address.

Essentially you need to repeat steps 5 to 7 until you get to a more likely culprit (most likely a PC or a mobile device).

8. Identify the type of device issuing the bad password

If it's a PC then running PING-a <IP_Address> will give you the host name. At which point you can remind the user about them using this PC recently and how they really ought to log off when they're done.

If PING-a doesn't return a Host Name, lookup the MAC Address for the leased IP address in the DHCP Management.

9. Lookup the MAC Address Vendor

Enter the first three bytes of the MAC address in to http://www.macvendorlookup.com (other, similar web sites are available).

These instructions were taken from: http://community.spiceworks.com/how_to/show/48758-trace-the-source-of-a-bad-password-and-account-lockout-in-ad

-saige-
0
cocosysengAuthor Commented:
I've been using this utility to monitor the bad password hits.  I just went through it with my team member, and we're not seeing any of these events in the event viewer for any of the DC's in recent periods.
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

cocosysengAuthor Commented:
As far as the VPN goes, no, he is not connected to it...
0
MacleanSystem EngineerCommented:
I usually utilize Netwrix Lockout Examiner (No advertisement btw, there might be similar tools)
The free version generally gives enough information regarding the source of the lockouts, and in my experience works better than the MS Lockout tools (Could be that I am not adapt at using the lockout tools to their full functionality of course).

http://www.netwrix.com/account_lockout_examiner.html
0
it_saigeDeveloperCommented:
It could also be that you audit settings are too low to show the above events.  It wouldn't hurt to try the tool Maclean recommended.  If that doesn't work we can visit the audit settings.

-saige-
0
MacleanSystem EngineerCommented:
On that note from it saige. Do indeed read the small manual which comes with the netwrix tool if you decide to try it.
It tells you which audit settings are required, and how to set this via GPO. Hope it helps.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
cocosysengAuthor Commented:
We got to the bottom of this.  Cached credentials again...
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Networking

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.