The reference account is currently locked out

[kennysarmy]

 

If a student messes about and enters their password wrong a number of times they are locked out.

 

How can we tell in AD if this is the case?

[bald_pig]

On the user's account tab, if it's locked out it will say so under the "unlock account" checkbox.

[bald_pig]

To get more detail of the lockout, use the lockout status tool and check the event, most of the time you can determine what machine the login attempts have come from.

https://www.microsoft.com/en-gb/download/details.aspx?id=15201#:~:text=Account%20Lockout%20Status%20(LockoutStatus.exe)%20is%20a%20combination%20command,about%20a%20particular%20user%20account.&text=LockoutStatus%20collects%20information%20from%20every,the%20target%20user%20account's%20domain.

[FragglePete]

We run a PowerShell script which is triggered by an Event ID of 4740 in the Security log on a DC. This e-mails us when an account gets locked and tells us where from. Useful as students here think it's funny to lock out each others accounts, so when we see a whole pile of them come in from one specific computer we can pounce on them quite quickly and get it dealt with.

 

Pete