Announcement

Collapse
No announcement yet.

User locked out randomly

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • User locked out randomly

    Hello team,

    How do I pin point where the account been accessing from? I have account that locked out left and right. And I need to know if I can pin point where or who try to use that account? especially my domain admin account that never been shared out.

    thanks,
    HN

  • #2
    Re: User locked out randomly

    The securtiy log on your domain controller will provide more info,

    9 times out of 10 though a randomly locked account is usually from an installed service that is trying to run as your account

    Comment


    • #3
      Re: User locked out randomly

      try to check your screen saver policy

      Comment


      • #4
        Re: User locked out randomly

        Are you saying "The Domain Admin" is getting locked out?
        I would say thats "unpossible" but it appears it can happen, although an automatic unlock will occur:
        http://blogs.dirteam.com/blogs/jorge...21003F00_.aspx

        Anyway, use the Account Lockout Tools (http://www.microsoft.com/download/en...ng=en&id=18465) to identify which DC is doing the lockout, then check logs more closely. IMHO one of the most likely causes is cached credentials somewhere -- have you changed the admins password sometime recently?
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment


        • #5
          Re: User locked out randomly

          I usually blame on users when they called me up and said "My account locked, and they told me that they only tried their password once" our group policy locked out after 3 tried. But we have 3 network admins accounts for our 3 IT staff. our account randomly locked during the day even. so we know that is something is odds or not right on our network. We really need to figure out what causing this issue etc..

          I never change my password since day one. My admin account and password is the same since day one.

          I will try the password locked tool and go from there. please let me know if we have any other suggestion before my boss spank me

          Thanks,
          HN

          Originally posted by Ossian View Post
          Are you saying "The Domain Admin" is getting locked out?
          I would say thats "unpossible" but it appears it can happen, although an automatic unlock will occur:
          http://blogs.dirteam.com/blogs/jorge...21003F00_.aspx

          Anyway, use the Account Lockout Tools (http://www.microsoft.com/download/en...ng=en&id=18465) to identify which DC is doing the lockout, then check logs more closely. IMHO one of the most likely causes is cached credentials somewhere -- have you changed the admins password sometime recently?

          Comment


          • #6
            Re: User locked out randomly

            maybe someone else has configured something to run as the DA account, but put the wrong password in somehow.. ?
            A scheduled task maybe ?
            Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

            Comment

            Working...
            X