User Account Locked

[Bankesy]

Good afternoon,

 

I've got myself stuck in a loop and I don't know how or what to try to fix it. I put in a new fine grained password policy a couple of weeks back and everything has been fine but now I've got one user for who the AD account just keeps locking.

 

I think I've made it worse by trying multiple password resets and unlocks, has anybody seen this sort of thing before? I know I have in my last role but can't remember the fix.

 

Thanks as always.

[Davit2005]

If you have multiple DCs you find out the one that the user is currently locked out on then if you have security auditing on you can sometimes track it down to a source IP where the account access is been denied from.

 

 

https://www.microsoft.com/en-gb/download/details.aspx?id=15201

 

A previous thread on the subject

 

https://www.edugeek.net/forums/windows-server-2016/208820-account-lockout-issue.html

[old_n07]

Does the user have emails on a personal device with a stored password that is locking the account?

[k-strider]

when this happens to us quite often its the users phone hitting radius server for wifi auth using old credentials

[Bankesy]

Thanks everyone, I had considered it might be related to e-mail on personal devices.

 

It's been happening to a few more users since so I do need to get to the bottom of this.

 

I put the policy in by targeting a specific security group that only contains staff so I've managed to avoid breaking anything too important.

 

We don't use AD credentials for connecting to the wireless so I don't think it's that.

 

I might just take my policy out and start again.

[Davit2005]

We did at a previous place have issues with this. People changed passwords but were still logged in on another PC. Setting up a nightly shutdown routine sorted a lot of these but quite a few were they were still logged into outlook on a mobile.

[GeneMoody-Action1]

This sort of thing can also happen when someone maps a resource to a sever, using alternate credentials and chooses to save them.

Or when scheduled tasks are set up as credentialed.

 

I have tasks set up to monitor EVT: Security for 4740, and each time a computer locks out it generates a help desk ticket with the event details who was locked out and from what computer.

Once, helpdesk contacts user to see if they need assistance, and escalates if user is none the wiser as to how.

Twice, escalated automatically.

Three+ times escalated to admin.

[triggmiester]

I'd be interested in knowing how you did this, if you'd be willing to share the info? Powershell?

[GeneMoody-Action1]

Yes, I use a powershell script, scheduled task, and email / ticket system.

I impersonate the user so the "Mail my manager when I submit a ticket" follows through.

 

Task is triggered on 4740 event, script retrieves last 4740, strips out details, builds a message and sends.

 

[davinderkundi]

That’s a pain. The user might have a device or app using an old password, which could be locking the account. Check for things like email clients or mobile devices trying to log in. You could also enable account lockout tracking in AD to pinpoint the issue.

[triggmiester]

That's great! Just to clarify when the scheduled task picks up the event ID, then it runs the powershell script?

[GeneMoody-Action1]

Correct, when you create a task one of the options when you add a trigger is "On an event"

And in case you did not know and or never noticed, when in the event viewer, you can right click an event and choose "Attach a task to this event", saves the guesswork on getting the trigger details correct.

 

Just be careful especially in events you expect to happen rapidly or in high volume.

There is a massive race condition there, so what can happen is you catch the first event but by the time the script fires and reads yo read the "top 1" and it is an event that is newer, having happened between trigger and that read.

 

Also be very very careful on script security, when you reference a script on disk vs a one liner, one of my favorite ways to get escalation is when someone creates a folder of scripts with tasks tied to them, runs the task elevated but does not set proper ACLs on the scripts to edit!

(Happens more than you know)

 

An example of a oneliner below as well,

 

-Command "& {Send-MailMessage -From 'AD Monitor ' -To '[email protected]' -Subject 'AD Group Member Addition' -Body $((Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4728} -MaxEvents 1).Message) -SmtpServer 'smtp.example.com'}"

 

SO I will stress again, these are *ways* and nice tricks to have up your sleeve, if you expect high volumes though there are better logging/alerting products.