Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Windows account getting locked out frequently

Posted on 2016-09-26
5
50 Views
Last Modified: 2016-10-15
Dear All,

We are experiencing frequent account lock outs for a user and would appreciate some suggestions to find the root cause.

The user accessed the said account through VPN, where he was prompted for a Password change.
After this, the account has been continuously locked out, several times a day.

We tried using a tool called Netwrix, which spotted the account cache on the proxy to be the cause. But even after clearing the cache, the same result. Appreciate any inputs on this.

We checked, the user is not accessing his account from any mobile device
We also tried updating Microsoft updates

Regards,
T
0
Comment
Question by:TiazfaD
5 Comments
 
LVL 15

Expert Comment

by:John Tsioumpris
ID: 41815801
Are you 100% sure about his mobile devices...also what about virus/malware threat
0
 
LVL 26

Expert Comment

by:Dr. Klahn
ID: 41815810
Sounds like the VPN was not secure and his login credentials were captured by a hostile.  Would it be satisfactory to issue the user a new login, move his files, and delete the old login?
0
 
LVL 11

Accepted Solution

by:
Kevin k earned 500 total points (awarded by participants)
ID: 41815813
Here are the steps to troubleshoot the AD account lockout issue occurring numerous time a day. It will cover to trace the bad computer name from where account is locking out and steps to clear the cache: http://yourcomputer.in/windows-ad-account-lockout-numerous-time-a-day/

Also type Credential manager in the start menu and see if anything in there is saving your password to use.

Also have a look at the Account Lockout and Management Tools that is available from Microsoft. Specifically, LockoutStatus.exe and EventCombMT.exe. By using this you should be able to narrow it down quite a bit to make it easier to see.

Here are a couple more articles that might help:

Identify the source of Account Lockouts in Active Directory:
https://community.spiceworks.com/how_to/128213-identify-the-source-of-account-lockouts-in-active-directory

Troubleshooting account lockout the PSS way:
https://blogs.technet.microsoft.com/instan/2009/09/01/troubleshooting-account-lockout-the-pss-way/
2
 
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 41815858
Also try account lockout tool from Netwrix  (free). Includes a fill you can put on said machine to capture the event.
2
 
LVL 27

Expert Comment

by:Thomas Zucker-Scharff
ID: 41844851
Kevin seems to have the best solution and an extensive thought out post.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
A list of top three free exchange EDB viewers that helps the user to extract a mailbox from an unmounted .edb file and get a clear preview of all emails & other items with just a single click on mailboxes.
The basic steps you have just learned will be implemented in this video. The basic steps are shown to configure an Exchange DAG in a live working Exchange Server Environment and manage the same (Exchange Server 2010 Software is used in a Windows Ser…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question