Continuous domain account lock out.

I've dealt with these type of issues many times, and usually it comes down to where a user did not change their domain password on a mobile device after changing their password on their computer, which cause the continuous lock out.

This is my first experience with a user having continuous domain lock out issue. See log below. I am trying to trace the source. Per user, she does not have a mobile device or have another session on another computer. Is lsass.exe a suspicious .exe? How can I trace the source to find out where the lock out is occuring? She did mention that the auto-discover option does pop up every now and then.

Who is Participating?
Mohammed KhawajaConnect With a Mentor Manager - Infrastructure:  Information TechnologyCommented:
Try the following:
- Ensure the account is unlocked
- Have the user login
- Delete mapped drives
- Delete saved credentials in Control Panel
- Wait 30 minutes and see if problem happens
- If account doesn't lock they have the user try one application at a time to find out the offending application
Senior IT System EngineerConnect With a Mentor IT ProfessionalCommented:
Yes, usually it is saved proxy credentials or some 3rd party application which still using or saving the old credentials.
Typically Apple iTunes.
joukiejoukAuthor Commented:
It was discovered that the Mimecast auhtication add-on in Outlook was causing this issue.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.