Solved

Domain account lockout

Posted on 2016-09-16
2
34 Views
Last Modified: 2016-09-22
Occasionally, a single domain user account will lock out. The user is not logged in anywhere else as far as I can tell. I can unlock the account in ADUC, but the account will quickly relock itself as if a bad password were being tried multiple times. In order to resolve this, I have been restarting the Microsoft Exchange Active Directory Topology service on the domain controller. This prevents the continued lockout issue for this one user. Is there anything I should be looking at on this account specifically to prevent this from happening in the future? I've already had the user reset his domain password, and I don't suspect that his account is being brute-forced. Is there any explanation as to why restarting the AD Topology service fixes this issue? Is this a known issue and/or is there a permanent fix for this problem that I can implement on an SBS 2011 Standard server?
0
Comment
Question by:OAC Technology
2 Comments
 
LVL 16

Assisted Solution

by:Dirk Mare
Dirk Mare earned 250 total points
ID: 41802589
Seeing that you are restarting exchange services to "resolve" the issue, check the user computer for stored credentials and delete all credentials MSEXCHANGE. .

DirkMare
0
 
LVL 4

Accepted Solution

by:
Felicia King earned 250 total points
ID: 41803735
I would enable Netlogon debug logging and then look through the logs for 6A events which are bad password. Looking at that event as well as surrounding events will tell you exactly what is causing the account lockout.
http://www.eventid.net/display-eventid-4776-source-Microsoft-Windows-Security-Auditing-eventno-10736-phase-1.htm

https://support.microsoft.com/en-us/kb/109626
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I'm sure that every Windows systems administrator has written, or at least used, a batch or VBS login script at some point in their career, whether it is to map network drives, install printers, or set some user preferences.  No more! With Window…
Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now