my account keeps getting locked out

[leewakelam]

Hello,

 

Please can anyone help......

 

My account keeps getting locked out about every 3 seconds. I've reset my password, made sure im not logged on anywhere or on any Remotes. I can see via 'event viewer' and 'security' my failed login attempts but it doesn't give much information or where to look or which PC / Laptop it failed. Any help would be great as im loosing my mind here

 

Thanks in advance

[computer_expert]

Checked any old mobile phones/tablets with old wireless network details/old exchange details saved?

 

Any windows services configured to use your username/password to run?

 

Any scheduled tasks also configured to use your old credentials?

 

Any manually configured mapped drives using old credentials?

Edited June 11, 2020 by computer_expert

[elsiegee40]

Are we talking about your windows login to the network?

[FN-GM]

Do you have a disconnected RDP session on a server?

[bald_pig]

The AD lockout status tool will tell you which ad server locked your account, even viewer will then let you identify the ip of the machine that locked you out. Sometimes you may need to enable additional logging to get the ip.

https://www.microsoft.com/en-gb/download/details.aspx?id=15201

[Davit2005]

@bald_pig +1

 

If you are on a domain use the lockout tool. This will show you what DC you are locked out against. Then log onto that DC and check security audit logs which should point you in right direction.

 

I had to do this quite frequently at previous employment and it worked all of the time.

Edited June 11, 2020 by Davit2005

[leewakelam]

yes its my windows login to the network

[leewakelam]

thanks for the reply, i did all of that but the security log tells me nothing

[leewakelam]

thanks very much for your reply, our event viewer and then security tells me nothing at all, its useless. Can you point me in the right direction please how i may enable additional logging to get the IP. Any help would be much appreciated

[Davit2005]

Identify the Domain Controller if you have multiple using the lockoutstatus tool

 

Then in the security section of event viewer on the DC identified search for the keyword of Audit Failure. I cannot remember having to do anything to get this working on my DC at home.

 

That should show source IP address, sample from my home lab below.

 

 

Failure Information:

Failure Reason: Unknown user name or bad password.

Status: 0xC000006D

Sub Status: 0xC0000064

 

Process Information:

Caller Process ID: 0x0

Caller Process Name: -

 

Network Information:

Workstation Name: HOMEMB01

Source Network Address: 172.16.25.2

Source Port: 55606

Edited June 12, 2020 by Davit2005

[highsky]

This gives you something to work with:

 

https://www.reddit.com/r/sysadmin/wiki/lockouts

[mbedford]

Used to get this a fair bit at my employer. ALTools were great as people have mentioned above.

 

In order of frequency this is what it usually was

 

1. ActiveSync\Email on a mobile device - Check that you dont have device which is auto syncing with an old password

2. WiFi authentication where your username \ password is the authentication method

3. Service account on some process or scheduled task.

 

If you are on a domain, ALTools will work and the security log will point you in the right direction. Remember that if it is due to email syncing, the origin machine may not be what you are expecting, it could be an Exchange server which is the origin as that is handling the authentication, not the mobile device itself.

 

Mike

[Steven_Cleaver]

Could try this tool is free have been using it for a bit here as seem to get a few lockouts https://www.netwrix.com/account_lockout_examiner.html

 

Have found that removing cached password details from Credential manager helps here from device that is showing the issue but might be different in different environments.

Edited June 24, 2020 by Steven_Cleaver

[dubsdj]

You don't have any sort of service running that is using your credentials do you? Perhaps the password is wrong on the service and it locks you out after failed log in attempts.

[Jcx500]

Maybe a wireless device , eg a phone or tablet using old credentials for wifi maybe ?