Account Keeps Getting Locked Out

I have an issue with an Admin account that keeps getting locked out.  This happened after the password was changed.  I'm afraid that there is some sort of auto login setup on a server somewhere that is using the old password but can't seem to find it.  Can't find anything in the security logs.  Any ideas on how to track this down?  Seems like the account gets locked out after about 5 minutes after unlocking.  Any help is appreciated.  Thanks
swilliamson-mwnsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
In order to find out exactly where your account is locking out on you need to configure active directory auditing on Default Domain Controllers Policy. Once you have this enabled you will be able to reference the Security Logs on the Domain Controllers and this will provide info on where the accounts are locking out.

Configure Active Directory Auditing (HowTo on my site)
http://www.wsit.ca/how-tos/active-directory/configure-active-directory-auditing/

If you have several domain controllers this will be difficult to manage as the logs will be on the domain controller that the user account is authenticating to.

A great product to accomplish this is Active Directory Auditor by Lepide Software.
http://www.lepide.com/lepideauditor/active-directory.html

This software will outline in a detailed report exactly where the machine is locking out on.

Will.
1
diperspCommented:
I've used the LockOutStatus tool in the below download from Microsoft to help in finding this.  Could also be a service set to run as admin or if the admin account is logged in somewhere from before the password was changed.

https://www.microsoft.com/en-us/download/details.aspx?id=18465
1
swilliamson-mwnsAuthor Commented:
Guys,  Thanks for the replies.  

Dipersp,  Is the lockout screen app supposed to tell you what computer is causing the lockout?  If so, then it tells me that the DC is causing the issue and i see NO services or tasks that are running with that account.  It loks out within a couple minutes.  Any thoughts?
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

McKnifeCommented:
You don't need external tools to find the machine where the lockout is caused. See my comments here http://www.experts-exchange.com/questions/28693377/Password-Lockout-of-a-user.html where I write "To understand and find that: Stage a lockout with a test account and have it lockout on your own workstation. Then look into the logs at the DCs searching for your own IP."
1
swilliamson-mwnsAuthor Commented:
I could not find a way to determine what was causing this issue since it was from Multiple locations so I deleted the account and recreated a new one.  Thanks for all the suggestions
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
McKnifeCommented:
Hm, had you given feedback, we would have found a way, for sure. Next time :)
0
swilliamson-mwnsAuthor Commented:
I do apologize for that.  Had too many issues going on at once.
0
McKnifeCommented:
No problem. We all know how it goes in IT.
0
swilliamson-mwnsAuthor Commented:
You got it.  Thanks for understanding.
0
Seth SimmonsSr. Systems AdministratorCommented:
This question has been classified as abandoned and is closed as part of the Cleanup Program. See the recommendation for more details.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.