asked on

Windows 8 Client / Windows Server 2012R2 DC - Repeated lockouts of domain admin account emanating laptop not in domain

My partner, Mike, and I just set up a new Windows Server 2012R2 domain controller for our big client. Since the new server has come online, my domain admin account has been locked out 5 to 10 times per day. I checked the security log on the new server and, sure enough, repeated audit failures for my user account come up with the "source workstation" being my laptop. The screenshot below shows a typical audit failure.

Additional details

I've been logging in via RDP to the new server, the old server (which will remain online for another week or two), and several office workstations repeatedly over the past few days setting up the office's custom app (which is MSSQL / Access / .NET based). The lockouts are occurring when I'm logged to one or more machines and when I'm not logged into any machine and my laptop is simply connected to the LAN.

I've been wracking my brain wondering what process on my laptop could be hitting the server with my local credentials and producing the lockout. (Or, perhaps my laptop has cached my domain credentials from my client's domain and is attempting to login using an old password.)

It's worth noting that my local user account matches my domain account somewhat. MyLaptop\jdana, PW = MyPassord and MyClientDomain\jdana PW = MyPassword.

I used to use Windows credentials on my old laptop (Control Panel\All Control Panel Items\Credential Manager) to make accessing my clients' networks easier, but Windows credentials can produce lockouts. I haven't used them in years.

Before the new server came online, I wasn't seeing any lockouts.

My client Windows 8 workstation is running in an OS X / Parallels environment.

McKnife

Usually tasks, services or the credential vault. Checked tasks and services?

jdana

ASKER

Definitely checked tasks and services. Should have noted this in the posting.

EE suggested the following link. I'll give this a shot: https://www.experts-exchange.com/articles/532/Finding-root-cause-of-Account-lockouts.html

McKnife, don't hesitate to let me know if you have other suggestions.

J

ASKER CERTIFIED SOLUTION

McKnife

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

jdana

ASKER

I'll give it a shot. The easy solution: just archive my old domain admin account and create a new one. I'll give the logging a shot and then fall back on the easy solution. Thanks again McKnife.