Track Cause of user lock out?

[jmair]

I have a user who is being locked out about every 30min or so. I can see when the teacher is getting locked out in the Event Logs, but I cant find what is attempting to authenticate as her. Any ideas on where I can look to see What/where the login attempts are coming from that would cause the domain controller to log her out?

[jslate1980]

Had the same issue recently. Worked out it was being caused by our newly installed smoothwall. By looking at authentication logs in event viewer on the primary domain controller. Forgot to mention when it was installed that we used auth lockout policies. Was a tick box in authentication on the smoothwall.

[smarties11]

I have a user who is being locked out about every 30min or so. I can see when the teacher is getting locked out in the Event Logs, but I cant find what is attempting to authenticate as her. Any ideas on where I can look to see What/where the login attempts are coming from that would cause the domain controller to log her out?

 

Filter the security log on your domain controllers for event ID 4740. This will give a calling computer name which is the source of your lockout.

 

The most common cause for us is that the user has changed their password but not updated it on their BYOD device Wi-Fi connections (we use 802.1x authentication for staff Wi-Fi)

[Norphy]

Either that ^^^ or you have an on-prem Exchange server and the user has an account on it connected to their phone with an outdated password.

[Jamo]

Use the account lockout tool to find which DC did the locking

 

https://www.microsoft.com/en-gb/download/details.aspx?id=18465

 

Then find the event which caused the lock and it will guide you towards the server or client station which initiated the request which resulted in the lock.

[jmair]

Either that ^^^ or you have an on-prem Exchange server and the user has an account on it connected to their phone with an outdated password.

 

This may actually be the issue believe it or not. HA!

Thanks all for the suggestions, it's much appreciated.

[Norphy]

believe it or not. HA!

 

Oh, I believe it. Back when I helped manage on-prem Exchange I saw it many times. And there is usually no kind of thanks from whoever it is when you get it sorted.

[Duke5A]

Security logs don't replicate. You can use the Exchange Management Console to fix this on your end. Under 'Recipient Configuration' find the user's mailbox and in the actions pane you should see a 'Manage Mobile Phone' option. Any user that has a device using Active Sync will have this option. Under here you can break the Active Sync trust and Exchange will stop listening to the device. The security logs on the Exchange server should also show the authentication failure and will give you the public IP of the offending device if you were interested.

[MarcBeaudoin]

The security logs on the Exchange server should also show the authentication failure and will give you the public IP of the offending device if you were interested.

 

By any chance, do you know where is this security log with the IP?

[Duke5A]

By any chance, do you know where is this security log with the IP?

 

Security Log under Event Viewer on your Exchange server. Task category will be 'Logon' and it will contain the the username and other bits of information including the IP address of where the request originated. If it happened offsite then it'll be the public IP of the device itself or gateway it was routed out of.