User AD lockout

[andy_nic]

Hi All,

i have a user who keeps geting locked out every 1-2 hours is there any log which i can look at to see roughty what is causing this to happen?

 

Andrew

[MrEprise]

You need to look at the Security audit logs on your DCs - more specifically the Failure entries as this will tell you which computer is locking the account out.

 

I had one very recently where a user account was added to the Credential Manager on a non-domain PC allowing the user to print from that machine. We have a password policy which changes the password every 90 days, of course the one on the standalone didn't get changed locking that user out every 5 minutes.

[free780]

Ive got the same thing. I'm resorting to wireshark soon as I can't identfy the process which is causing the lock out. Ive tried a fresh pc so its not in the profile we use local. Her phone had exchange cresentials now removed. Dc logs show the failures from the pc.