Solved

AD Account Keeps Getting Locked pt 2

Posted on 2015-02-04
2
219 Views
Last Modified: 2015-02-05
I've been running into a problem recently that my AD account keeps getting locked out.  The lock is coming from three different computers, but so far, only those three - as indicated by event ID 4740 on our AD controller.  The lock out is occurring several times per day, but I haven't been able to identify a pattern.

These are computers that I rarely work with, and haven't touched any of them for at least a year (before investigating this issue) - one of them I've never worked on.  Also, all three aren't used much at all in daily use.


Event ID 14 on the suspect machines state that the password stored in credential manager is invalid.  That said, I have checked logged in both as local admin and myself and there are NO credentials stored in the Credential Manager.  Further, on all three machines, I have removed my local account from the registry - and I am still getting locked out.

So what is my next step?  This is driving me crazy.

TIA
0
Comment
Question by:Geisrud
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
2 Comments
 
LVL 14

Accepted Solution

by:
Geisrud earned 0 total points
ID: 40589845
I believe I found the answer.  Just want to post here for documentation and maybe it can help someone else.

https://social.technet.microsoft.com/Forums/windows/en-US/e1ef04fa-6aea-47fe-9392-45929239bd68/securitykerberos-event-id-14-credential-manager-causes-system-to-login-to-network-with-invalid?forum=w7itprosecurity




There are passwords that can be stored in the SYSTEM context that can't be seen in the normal Credential Manager view.

Download PsExec.exe from http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx and copy it to C:\Windows\System32 .

From a command prompt run:    psexec -i -s -d cmd.exe

From the new DOS window run:  rundll32 keymgr.dll,KRShowKeyMgr

Remove any items that appear in the list of Stored User Names and Passwords.  Restart the computer.
0
 
LVL 14

Author Closing Comment

by:Geisrud
ID: 40591127
After waiting a while and confirming that my password is not locking out anymore, I'm convinced this is the fix I needed.  Hope this can help someone else too.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article outlines the process to identify and resolve account lockout in an Active Directory environment.
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question