Problem Users are being randomly locked out

invierno · Jul 5, 2010

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

The Netwrix Account Lockout Examiner tool is fantastic for stuff like this. Its biggest limitation is that the computer where the lockout is suspected to be occurring must be in the office rather than at a remote location (ie, it cannot locate issues on computers connected through VPN).

These tools can come in handy too:

http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

onoski · Jul 5, 2010

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

nugget said: ↑

This is really doing my head in.

I recently installed a program from NetWrix that supposedly can trace the reasons for account lockouts. It showed me this morning that the lady in question's account is locked out. I looked at her user account details in AD and sure enough her account shows that it is locked. The strange thing is this time, as well as being logged in she can use outlook too. Normally if outlook asks for her credentials she gives them in, they aren't accepted and after 3 times the account seems to lock itself (although already logged on) and she cant use outlook any more until we unlock the account.

This morning she can give her credentials in, outlook accepts them and she can continue on as normal even though her account shows as locked. Looking in the logs I've found 5 events with the ID 644 which indicate bad password events. These correspond with the 5 account lockout records I see in the NetWrix program.

One difference that I see between her account and another account that was also locked is the domain controller. One account was locked showing the file server domain controller and her account shows the mail server domain controller (we have 2 DCs, one set up as file server and the other as mail server).

Is it possible that there is a communication problem between the 2 DCs?
Click to expand...

I had three of the exact same issue you're experiencing and have explained a fix in the above. Try this and see if you get any luck as this issue is purely down to some DC's not replicating properly. Best wishes

Asterix · Jul 20, 2010

any resolution to this?

Log in or Sign up

Problem Users are being randomly locked out

invierno Nibble Poster

onoski Terabyte Poster

Asterix Megabyte Poster

Share This Page

Navigation

Popular Forums

Useful Links

Log in or Sign up

Problem Users are being randomly locked out

invierno Nibble Poster

onoski Terabyte Poster

Asterix Megabyte Poster

Share This Page

Useful Searches