We help IT Professionals succeed at work.

2 user accounts keep getting locked out every 30 minutes

We have 2 users that their accounts keep getting locked out every 30 minutes.
We have tried many things to get this to stop with no success.
The server is running 2012 R2
I even tried deleting all from credential mgr, but still the accounts get locked out after 30 minutes.
Anyone have any good idea on how to find out what is causing this?
Comment
Watch Question

Hemil AquinoNetwork Security Engineer
Distinguished Expert 2018

Commented:
When you say getting locked, you mean the computer or the user itself in active directory.

Author

Commented:
User account in AD
Network Security Engineer
Distinguished Expert 2018
Commented:
Few questions for you.

1- Does the user has access from the outside using RDP? - someone might be trying to brute force the user account and thus the account gets locked.

2- Do you have any Map drive configured using old user/password credentials? Perhaps both users have some cached credentials saved and every time the computer tries authenticate with the server sees it as a login attempt.
Distinguished Expert 2019

Commented:

Author

Commented:
I did. I ran a script and it is pointing to the 2 users computers in the office. If they vpn from home, they don't experience the issue
Distinguished Expert 2019

Commented:

ok then its probably a service running on the local machines.

This is probably a service, but may also be a mobile device with an old stored password.

In an environment where you have developers, hard-coded credentials aren’t a common culprit.