Account lockouts

[hpsait]

My account gets lockout several times a day. Unfortunately we dont have access to our DC's so troubleshooting is a problem. I have done all the necessary checking but cannot find the problem. I'm using lockoutstatus tool to identify the DC but this does not help me much. What can use to trace the problem?

 

[Roadki11]

I would look or get someone to look at the audit events on the DC to see what machine or machines the failed logon attempts are coming from. Probably an old scheduled task trying to run with old credentials. If not the audit logs should lead you closer to a solution.

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[hpsait]

Unfortunately our DC's are manageed by an outsource IT support company and I cannot get any info from then as yet. Are there any other ways how I can check what is causing the lockouts?

 

[GrimR]

On our network through linux proxy our windows users get locked out most of the time due to some sort of internet activity, e.g a program trying to get updates etc

MCITP:EA/SA, MCSE, MCSA, MCDBA, MCTS, MCP+I, MCP

 

[cdtech9198]

do you have a mobile device trying to connect with old password?

 

[NoCalAdmin]

cdtech is onto something. I have seen this issue on my domain when staff are logged into a machine and on a second and then change their password. The system freaks out and causes the account to send alerts... we don't get kicked or locked but I believe your symptoms resemble this cause... can you tell if the user or machine has a second session open on the domain?

Tom