Constantly keep getting locked out of RDP and emails!

[DMurray]

Please help!

 

Constantly keep getting locked out of RDP and emails!

[nathan3388]

What you mean keep getting blocked, anymore information?

[DMurray]

What you mean keep getting blocked, anymore information?

 

We have one user account that is getting locked out every 40-50 minutes, even if the user is already logged in and working. All of a sudden, Outlook will prompt them for their password or it will prompt them when they try to connect to our RDC. The password is not expired, We've had them reset it and I've rebooted the server but nothing has worked.

[FN-GM]

Check they don't have email configured on a phone or tablet with an old password.

 

The same can happen if you have Radius configured with a WIFI network.

[DMurray]

Check they don't have email configured on a phone or tablet with an old password.

 

The same can happen if you have Radius configured with a WIFI network.

 

Indeed this was checked - all ok.

[FN-GM]

Is this user an administrator will also login to servers?

[Norphy]

In my experience there are two likely explanations:

 

1) they have a device connected to their email with an old password which is constantly trying to connect which is causing the account to lock

 

2) they have a device trying to connect to your wireless network with an old password, again causing their account to lock.

 

Log onto your domain controllers and look for event 4740. That should tell you the IP address that’s locking the account out.

[Davit2005]

SysInternals do a tool called lockoutstatus.

 

I've used this before, it identifies which DC they are getting locked out on, then if you check the DC's security logs you should be able to find failed logon attempts and the source. Frequentley this was mobile devices which had old passwords set for email etc. We actually shutdown all PC's over night and this fixed a lot of these issues where people were leaving themselves logged in and changing passwords.

[Roberto]

SysInternals do a tool called lockoutstatus.

 

I've used this before, it identifies which DC they are getting locked out on, then if you check the DC's security logs you should be able to find failed logon attempts and the source. Frequentley this was mobile devices which had old passwords set for email etc. We actually shutdown all PC's over night and this fixed a lot of these issues where people were leaving themselves logged in and changing passwords.

 

We've had this with a mac technician in our media department who logged in to their mailbox on an old mac and didn't make the connection when we asked about leaving himself logged in on older devices. Also this particular person thinks Macs "never ever need a reboot" and won't do as he's asked by the helpdesk team so... well you can imagine.