• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 556
  • Last Modified:

user accounts are constantly locked out - need

I did a trace and found that most of the lock outs seem to originate from users going to the CAS system (exchange 2010) via their mobile devices.

ex. one of many that  I see in the event viewer of the client access log. They are not all the same type but the same Event ID.

Subject:
      Security ID:            NETWORK SERVICE
      Account Name:            CASName$
      Account Domain:            mydomain
      Logon ID:            0x3e4

Logon Type:                  8

Account For Which Logon Failed:
      Security ID:            NULL SID
      Account Name:            staff@92y.org
      Account Domain:            

Failure Information:
      Failure Reason:            Unknown user name or bad password.
      Status:                  0xc000006d
      Sub Status:            0xc0000064

Process Information:
      Caller Process ID:      0xa58
      Caller Process Name:      F:\Program Files\Microsoft\Exchange Server\V14\Bin\EdgeTransport.exe

Network Information:
      Workstation Name:      CASName

I'm having a hard time understanding what some of these things mean. I've read the documents and stuff but I'm still a little unsure. Ex. below

- Logon type 8

- Call Processor Name :Windows\System32\inetsrv\w3wp.exe versus Caller Process Name:      Program Files\Microsoft\Exchange Server\V14\Bin\EdgeTransport.exe (aren't they both going to owa?)

At this point I'm trying to figure out if they locked their account first which caused their emails to fail or something on their mobile device failed which caused their accounts to be locked.
0
iamuser
Asked:
iamuser
  • 4
  • 2
2 Solutions
 
Guy LidbetterCommented:
Have you considered if they change their password and haven't updated their accounts on their phones?

Is this happening regularly to everyone or only some people?
0
 
iamuserAuthor Commented:
This is happening to number of people. All random. While I know chances are they may have changed their passwords somewhere . And that is the cause if the issue I do need some proof. Some of the people getting locked on senior directors and vp's. I want to make sure that I can show the flow if asked.
0
 
iamuserAuthor Commented:
And of course they all swear that nothing was changed, that they changed everything, or that they didn't type anything wrong
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
David Johnson, CD, MVPOwnerCommented:
They had to change their password in Windows as per company policy they now have to change their password on any other device that they have that connects to the domain.  They probably don't remember changing their password.

2 line vbscript

Set objUser = GetObject("LDAP://CN=myerken,OU=management,DC=Fabrikam,DC=com")
Wscript.Echo "Password last changed: " & objUser.PasswordLastChanged

Open in new window

http://bit.ly/1B810H1
0
 
iamuserAuthor Commented:
I ran the scripts on 2 users who had problems just recently and the last time both changed was at 1/24 and 1/16. So it's not a password causing it.
0
 
iamuserAuthor Commented:
I am shutting down this thread and opening a new one
0
 
Guy LidbetterCommented:
Please split the points appropriately... As the accepted solution was exactly what i had suggested as being the cause in the first place.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now