Account Lockout Problem

[Udir]

We have a generic admin account that we use on all of our servers. For some strange reason about every 10 minutes this account gets locked out. I have a suspect server that has

Event ID 539 with the user name saying the Account is locked out. Logon type = 2 with the process being ADVAPI.

I have the following Auditing policies turned out with Failures audited: Audit Account Logon Events, Audit logon events, and account management.

I cannot figure out what is running on the suspect server to determine how it is getting locked out every 5 minutes.

Any idea what I can do to determine what is going on? Thanks.

 

[jasonboyes]

Did you change the password? If so try these options

1)Does the Administrator account also take care of some automated processes ei backup, exchange server, duplication. If so confirm that these services are using the proper password for the account.

Also check to see if someone mapped a drive and is using Administrator account with the wrong password.

Jason

 

[Udir]

I checked that, there are no mapped drives on the server in suspect. And I use a different account for backups.

 

[stresco]

Did you change your password while you were logged into multiple machines? Ive seen our users do this many times and it always screws up their accounts and locks them out.

 

[Udir]

We haven't changed the password on this particular account.

I've checked the machine for virus's and it didn't have any, but it did get infected about a week ago when this all happend. I have clean it off. I am still getting the same event log error message with the process being ADVAPI. I cannot figure out what is trying to log in. It tries to log in about every 1 to 1:30. I appreciate all the suggestions.

And ya, I have seen accounts lock up when the password has been changed.

 

[br0ck]

I'm having the same problem
out of the blue i start getting the error
i checked and there are no service nor mapped drive

any fixes ??

 

[candyman200]

Has there been anything new on this???

I have ONE USER who is getting locked out, his account is trying every 10 minutes. I can see a time it stops (near 11pm) and starts (near 8am) but the computer is listed as our DC.