identifying root cause of Windows account lockouts

[ranj]

Hi All

 

I have noticed that my account in AD has recently been locking out and dont know why. Its since I have changed my password. I now in the past we have had this issue and I want to try to find the root cause for this issue and identify a simple way to address this.

 

Done the usual checks like changing my password on active sync (as that is usually a culprit) removed all credentials in credentials manager on my client machine.

 

Now I have used the security log on our PDC emulator to help me identify the computer which I think might be locking out my account and I think it is event ID 4740 in security logs which gives me the answer however I am not 100% so just wanted to ask if anyone knows a better way (possibly in the form of a windows app) that will tell me this information with ease, if not an app possibly a script of some sort.

 

 

It's getting really annoying and just want to find out the root cause.

 

Any advice would be appreciated.

 

Thanks

[FN-GM]

It can be caused leaving a disconnected RDP session open on a computer / server.

 

I use the attached script to find out on what machine accounts are locked out from.

Get-LockedOutUser.ps1

[ranj]

Thanks a million for that, I have tried to run the script from my own machine or from one of the AD servers I get the following message:

 

[dapaulio]

Iv kniwn this to happen when techies have installed a piece of software that requires domain user credentials to export data to third party software eg AD or sims info.

Have you used your credentials in any software services installed on your servers.

If so you would need to change the password in the setting of every software you have used domain credentials

 

If thus is the case I would ideally create a domain user account for each instance that software require domain level authentication. Lock it down so that it can only be used on the server installed on and document it

[dapaulio]

Before you continue ensure you understand what each line of code is doing to your server. Whilst fn-gn is probably upstanding gentleman that would not dream of harming anyones network it is very easy to tell someone in need to go run some code.

It is good practice to make sure you understand what each line is doing.

Once you are ok with this

 

Type in ps to obtain your current ps executionpolicy

Get-executionpolicy

 

If the ps script is written correctly and assuming it is unsigned it could be the servers security policy blocking it from running

The policy should be temporarily set to unrestricted.

Run in ps

Set-executionpolicy unrestricted

 

Remember to set it back

[ITGuyWestMidlands]

Check for scheduled tasks on the caller computer mentioned in the event log screenshot you posted