My User Account Gets Locked Out All the Time for No Apparent Reason

See title. I am a domain admin and my account gets mysteriously locked out a LOT. I have enabled Success and Failure events for the Local Policies Audit account logon events, audit logon events as well as teh Advanced Audit Configuration settings audit account lockout, audit logon, audit logon, audit network policy server, audit other logon/logoff events and I am still not able to see the source of the lock out. Most of the time the "Calling Computer" field is blank. Can anyone offer a suggestion to find the source of this problem? By the way, I have had the same password for almost a year and all of my devices that connect to the domain use this password. I am running out of ideas.
Todd WilloughbyLead System EngineerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

zalazarCommented:
It's a Windows 2003 domain correct ?
Could you maybe tell if you are using Event ID 644 for looking up the "Caller Computer Name".
For Windows 2008 it's Event ID 4740.
A lockout can have several reasons like a disconnected RDP session or if the username/password is configured somewhere, e.g. in a scheduled task.
Toni UranjekConsultant/TrainerCommented:
You can use Account Lockout and Management Tools, to help you resolve the issue.
http://www.microsoft.com/en-us/download/details.aspx?id=18465
zalazarCommented:
One of these tools from Microsoft is Account Lockout Status.
https://technet.microsoft.com/en-us/library/cc738772(v=ws.10).aspx
https://www.microsoft.com/en-us/download/details.aspx?id=15201 
But if your domain is small then most of the time looking up an event with ID 644 or 4740 on all domain controllers will suffice.

If the "Caller Computer Name" is still blank then you might have a look at some non Windows applications or devices like switches/routers/proxy or other where you have authenticated with your user account.

If the lockout occurs regularly then you might try to turn on debug logging for the netlogon service.
https://support.microsoft.com/en-us/kb/109626

Open a command prompt (cmd.exe) on the domain controller and use "Run as administrator".
Start debug logging via:
nltest /dbflag:0x2080ffff
net stop netlogon
net start netlogon

Open in new window

Wait for the lockout to occur by checking the Eventlog.
Immediately after that check file "C:\Windows\debug\netlogon.log" by opening it with notepad.

Stop debug logging via:
nltest /dbflag:0x0
net stop netlogon
net start netlogon

Open in new window

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
zalazarCommented:
Could you maybe give an update on this.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.