Account lockout issue

[seahorse]

Hi all

 

I have a number of users who keep getting logged out regardless of whether idle or their user profile is on use.

This ranges from only being logged on to one host machine or multiple.

IN one instance it is an admin account so I thought perhaps there was a Scheduled Task running somewhere with invalid credentials, however I have so far been unable to locate the root cause.

 

Would anyone have any experience with tracking down the host machine that was responsible for locking out an account?

I have looked at making use of a powershell script that supposedly reports the state of an account and then can source what led to the lockout however I've not had much look with this one.

 

I'll reference it in case it helps anyone else out in the future:

 

https://www.business.com/articles/powershell-active-directory-lockouts/

 

If anyone has any idea I'd be glad to here them as it's been bugging me for some time.

 

Many Thanks

 

Seahorse

[Davit2005]

If you have multiple DCs you can have a look at sysinternals account lockout status tool, forget the actual name off me head.

 

This will indicate what DC the account is getting locked out on, if you then go onto the DC indicated and check the security logs for the user this should help locate where the attempts of login are coming from.

[seahorse]

Thank you Davit

 

I have considered this but can never find what I expect to find in the event viewer log.

Would I be looking for 'Audit Failure' messages poporting to the user account in question?

So far I have located messages again specific accounts but nothing relating to lockouts and resultant applications / services.

 

Many Thanks

[bald_pig]

Thank you Davit

 

I have considered this but can never find what I expect to find in the event viewer log.

Would I be looking for 'Audit Failure' messages poporting to the user account in question?

So far I have located messages again specific accounts but nothing relating to lockouts and resultant applications / services.

 

Many Thanks

 

You're looking for "audit failure" events, they will only tell you the user account and the machine the attempt originated from.

[seahorse]

Thank you.

Indeed this is only reporting the DC the account authentication was attempted from

[Davit2005]

Thank you.

Indeed this is only reporting the DC the account authentication was attempted from

 

It should show the source, this may include exchange servers via webmail/outlook if you are using on site exchange server. It will not show the application but it should help you find the source machine where attempts are being made.

[Rob_D]

When we've had problems like this before (it's nearly always turned out to be a phone trying to connect to the wireless/365 email with old credentials), we use the Netlogon debug logs. Turn on logging until the accounts are locked out again and search the log-file for the username. It should have the machine name/IP for where the failed request came from.

Don't forget to turn the logging off when you're done though otherwise the files get huge.

 

https://support.microsoft.com/en-gb/help/109626/enabling-debug-logging-for-the-netlogon-service

[Davit2005]

When we've had problems like this before (it's nearly always turned out to be a phone trying to connect to the wireless/365 email with old credentials), we use the Netlogon debug logs. Turn on logging until the accounts are locked out again and search the log-file for the username. It should have the machine name/IP for where the failed request came from.

Don't forget to turn the logging off when you're done though otherwise the files get huge.

 

https://support.microsoft.com/en-gb/help/109626/enabling-debug-logging-for-the-netlogon-service

 

Thanks @Rob_D I'll have to remember that one.

Edited August 7, 2019 by Davit2005

[seahorse]

Thanks Rob_D

I'm giving this a go whilst we speak.

[seahorse]

Unless I'm missing something obvious I couldn't find anything other than a success call from the account in question and only one time.

Does logging need to be set to a specific level for this to report what I need?

 

Thanks

[Rob_D]

It's always worked for us just using the command in the article on the PDC (Nltest /DBFlag:2080FFFF). If it's not picking up anything maybe try on the other Domain controllers.

[seahorse]

Thanks. It's definitely enabling the logging it just seems to be reporting very little. I'll turn it back on tomorrow and see what happens.

[enjay]

Do you have anything using Radius? We had an instance at my previous school of someone's phone having their old password saved in the wifi settings and that kept locking out their account. No obvious reason behind that as no other staff had the same problem, even with the same phone type.

[seahorse]

Haven't had a chance to try leaving the logging enabled for longer just yet. We have no radius enabled for our WiFi and the only email accounts enabled on phones are via the Google App on Android so it shouldn't interact with Active Directory.

I'm willing to put money on it being a Scheduled Task for the Admin user but I'd like to find a way to identify it easier.