Announcement

Collapse
No announcement yet.

User Account KJeeps Locking Out

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • User Account KJeeps Locking Out

    Hello, I have a user that is getting locked out 9 or 10 times a day for no reason. We have reset her password, changed it back to her old password, disabled and enabled her user account, reset her computer account, renamed her PC, rejoined the PC to the domain, restarted the PC and still no matter what she gets locked out even when she is not asked for her password. Windows 2000 domain, Win XP box. Any suggestions?

  • #2
    Re: User Account KJeeps Locking Out

    Check the services on the machine.
    Download the ALTools from Microsoft:
    http://www.microsoft.com/downloads/d...displaylang=en
    and see when specifically the account was locked out.
    Check the security logs on the DCs to see which machine and you should be able to find a service or program (or even a user) that is causing it.

    I think it logs 531 and 539 messages but you will be looking for something like:

    User Account Locked Out:
    Target Account Name: JBloggs
    Target Account ID: DOMAIN\JBloggs
    Caller Machine Name: A-SERVER
    cheers
    Andy

    Please read this before you post:


    Quis custodiet ipsos custodes?

    Comment


    • #3
      Re: User Account KJeeps Locking Out

      Go to the domain controller on which she has been locked out. Make sure you're auditing Account Management events, Logons and logoffs (success and failure).

      You're looking for Account Management Events from the "Security" source, in the security log - event ID 644 - with the text that Andy posted above. The "Caller Machine Name" will be the machine which tried to log on with her ID and an incorrect password.

      Favourite culprits:
      1. your Active-Sync server or your ISA box does the login - check her mobile device password is correct.

      2. Another workstation (one she VEHEMENTLY claims she never used before) is running a scheduled task with her credentials.

      3. Her workstation is running a scheduled task with wrong credentials

      4. Another workstation has been left logged in to her ID since before her last password change.

      5. **BIG FAVOURITE** she has cached or saved passwords for websites/applications on her machine. Check the "User Accounts" control panel applet on her machine, go Advanced, Manage Passwords.


      Tom
      For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

      Anything you say will be misquoted and used against you

      Comment


      • #4
        Re: User Account KJeeps Locking Out

        Thanks Guys! The ALTool worked!
        Again, thank you!

        Comment


        • #5
          Re: User Account KJeeps Locking Out

          No probs. Thanks for letting us know it was fixed.
          cheers
          Andy

          Please read this before you post:


          Quis custodiet ipsos custodes?

          Comment

          Working...
          X