none
AD Account Locking Frequently RRS feed

  • Question

  • We have only 1 user affecting in the company and his AD Account is locking out dozen times a day for months.  

    I have done the following:

    • Clear Temporary Files
    • There is no 3rd party devices
    • Delete Cookies / Temp Files / History / Saved passwords / Forms / from all the Browsers.
    • Delete all temp files.
    • Remove Mapped drives from my computer.  
    • Remove stored passwords from Control Panel
    • Check the Account threshold 
    • Reset password and forced password changed
    • Event viewer / auditing both from Server side / Client side (Not much luck)  
    • Lockout tool to check which DC locking out and event view logs from DC's(But nothing indicating why the account is getting locked)
    • New laptop issued
    • Last effort was to deleted AD account and re-create

    Anyone have any ideas? As this is frustrating issue to pin down

     
    Wednesday, April 29, 2015 4:46 AM

Answers

All replies

  • Hiya,

    This should give you the IP address of the server or client where this happens from:

    Lockout tool to check which DC locking out and event view logs from DC's(But nothing indicating why the account is getting locked)

    What does this map to?

    Wednesday, April 29, 2015 6:41 AM
  • Hello,

    When users account getting locked. Please run the following Microsoft Tool EVENTCOMBMT.exe and there is built-in

    option for account lockout events. in case you have windows 2008 or R2 on your DC's then include event id 644 & 4740 long with standard event id by default selected in search criteria. You need to include all your DC's and run the tool. once capturing is completed. It will create the log files under C:\Temp for each DC. Open the file in notepad and search the user id and it will give the IP address of the machine or device where users account is getting locked.  

    http://www.microsoft.com/en-in/download/details.aspx?id=18465

    Wednesday, April 29, 2015 7:43 AM
  • Account Locked Out Troubleshooting-EventCombMT - Have a look for details.

    http://social.technet.microsoft.com/wiki/contents/articles/4585.account-locked-out-troubleshooting-eventcombmt.aspx


    Regards,

    Biswajit

    MCTS, MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, Enterprise Admin, ITIL F 2011

    Blog:   Script Gallary:   LinkedIn:   

    Note: Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights..

    Wednesday, April 29, 2015 9:53 AM
  • Hi,

    Any updates on above?

    Monday, May 4, 2015 4:37 AM