Account Lockout Tracking

[FN-GM]

Hi,

 

My account was locked out today. I 100% know it wasn't me. It happened last week as well. So i am trying to track it down. So i have followed this - Using EventCombMT and LockoutStatus with 2008 R2 to find account lockout events | Doug G

 

I have found the log. Its saying "Caller Computer Name: FP-DC-03" - This is one of our DC's. How can i track down the actual source of these lockouts please? Can i get an IP address of the client?

 

Thanks

[colacao82]

Your not using Office 365 and recently changed your password, are you? Because I have and my account keeps getting locked out and I haven't found a fix yet!

[FN-GM]

We have office 365 using ADFS. I use Lync Online. Will have a check with that. Good tip. Thanks

[mikeyd101]

I had a problem with lock outs after I changed my password, account kept locking from different machines, it turned out that I deployed a scheduled task with my login as the run as account.

 

Almost drove me crazy trying to figure it out.

[colacao82]

No problem! Also we have a program called Userlock that alerts us if there is an unsuccessful login with any admin group account. It's pretty good.

[Byford-Rew]

Check out ADAudit it does ALL this and more. I've found it so beneficial that I've purchased a years subscription. http://www.manageengine.com/products/active-directory-audit/

[Norphy]

We sometimes have a spate of lockouts when user passwords change. Users forget to update the password on their mobile devices. The mobile device keeps on trying to authenticate with their old password and locking the account out.

 

May be worth checking your mobile if your work email is on there?

[FN-GM]

Hi,

 

Just looking at this. Its not a mobile device or office 365. Annoying me this!!

 

The problem with what @Byford-Rew suggested is I need to pay, just need something for this one off.

 

Thanks

[Firefox]

You should be able to go back to the "Caller Computer Name: FP-DC-03" and check it's local security log for the same time. This log entry should contain the IP address of the device ultimately responsible for the lockout. On the face of it, all lockouts report the caller as being a DC, as it's that device that handles the lockout request.