User Account Locking

[tmcd35]

Hi,

 

I'm looking for reasons a single users account would be, what appears to be, randomly locking. About 900 users and it is effecting only 1 person. I can't see any clues on her laptop as to what might be causing it and the timing seems wrong for students mucking about trying to guess passwords. Anyone got any clever ideas?

 

Thanks

[sted]

someone putting their laptop away switched on but something resting on the keyboard? or even just leaving crud on their keyboard/stuck keys etc

[Steve21]

A phone with an old password for email sync is usually our main culprit.

 

Steve

[Liam]

There is a password policy set that is being triggered by users trying to guess passwords.

We had a student trying to guess a member of staff account password and it looked it out.

[FN-GM]

If you have a computer logged on somewhere with her old password it can cause this. I kept getting locked out all the time, turned out I was logged into a server before my password changed. As soon as a I logged off the issue fixed itself.

[tmcd35]

If you have a computer logged on somewhere with her old password it can cause this. I kept getting locked out all the time, turned out I was logged into a server before my password changed. As soon as a I logged off the issue fixed itself.

 

Oh, this one is possible! I'm going to restart the machines in the maths office in a minute, force a logoff. It wouldn't surprise me if she logged in both in there and on her laptop at the same time.

[Sagima]

Phone / Tablet trynig to use an old password turned out to be the culprit 9 times out of 10 here

[localzuk]

Do you have any add on systems that tie in to Active Directory? Could that be passing a password incorrectly, and locking the account?

[tmcd35]

Do you have any add on systems that tie in to Active Directory? Could that be passing a password incorrectly, and locking the account?

 

Another one I've already thought of but can't find any evidence of. Most of our stuff is web browser based but it doesn't appear she is leaving the relevant pages open.

 

I've forced her to change her password this morning and turned off kerberos pre-authentication on that account to see if that will help.

[jamesb]

If none of the above work you can try and find the service/workstation causing the problem by turning on AD access auditing and tracing back the failed logon events: HOW TO: Audit Active Directory Objects in Windows Server 2003

[Davit2005]

This was a real problem for us, it nearly allways was the user was logged on else where, we tackled it 2 fold.

 

Making sure All workstations are shutdown at 10PM.

 

Use SysInternals lockoutstatus to find out what Domain Controller the users are getting locked out on and then look at the security logs to find out where the attempted logons are coming from. Using the lockout status tool you can unlock the password and then monitor how long it takes to get locked out again.

 

We find that the users are beginning to learn the hard way when they cannot log onto a machine that they have logged on elsewhere no matter how much they argue that they are not.

[FN-GM]

How did you get on @tmcd35?

[tmcd35]

How did you get on @tmcd35?

 

I think you were right. Reset her password and restarted any machine she'd been near that day. I've heard nothing since. Checked her account in AD a couple times and so far not locked.

 

I need to remember this in 90days when her password is next set to expire. Be interesting to see if it happens again then.