Solved

Domain account lockout

Posted on 2016-09-16
2
37 Views
Last Modified: 2016-09-22
Occasionally, a single domain user account will lock out. The user is not logged in anywhere else as far as I can tell. I can unlock the account in ADUC, but the account will quickly relock itself as if a bad password were being tried multiple times. In order to resolve this, I have been restarting the Microsoft Exchange Active Directory Topology service on the domain controller. This prevents the continued lockout issue for this one user. Is there anything I should be looking at on this account specifically to prevent this from happening in the future? I've already had the user reset his domain password, and I don't suspect that his account is being brute-forced. Is there any explanation as to why restarting the AD Topology service fixes this issue? Is this a known issue and/or is there a permanent fix for this problem that I can implement on an SBS 2011 Standard server?
0
Comment
Question by:OAC Technology
2 Comments
 
LVL 16

Assisted Solution

by:Dirk Mare
Dirk Mare earned 250 total points
ID: 41802589
Seeing that you are restarting exchange services to "resolve" the issue, check the user computer for stored credentials and delete all credentials MSEXCHANGE. .

DirkMare
0
 
LVL 4

Accepted Solution

by:
Felicia King earned 250 total points
ID: 41803735
I would enable Netlogon debug logging and then look through the logs for 6A events which are bad password. Looking at that event as well as surrounding events will tell you exactly what is causing the account lockout.
http://www.eventid.net/display-eventid-4776-source-Microsoft-Windows-Security-Auditing-eventno-10736-phase-1.htm

https://support.microsoft.com/en-us/kb/109626
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question