Accounts keep locking users out!

[miggins]

800 accounts on domain (mixed mode).
One account locks out every time the user logs in.
Another account locks out maybe a dozen times per day (still trying to find a pattern).

Both accounts have been moved to AD on 2000 server (this problem was happening before).

 

[peteway]

I'm not sure what it is off hand. But there are some account lock out tools available for server 2003 that you can download now for 2000.

http://weblogs.asp.net/Dbright/archive/03132003.aspx

at the bottom there is a link to the tools.
give that a shot...

 

[btnet]

Have you tried turning on auditing to see what's happening?

 

[ReddLefty]

BTNet is on the right track.. turn on your security auditing and find out which computer the failing is coming from. Often, I get users that lock out because they changed their password but were logged on 2 computers and forgot about the first one. Then the first one will keep trying with the old password, hence, getting locked out. It can apply also if you have tasks or services that start up with a specific username and password... they must all be checked to make sure that they are using the correct password. Better to use service accounts for those types of username password type services.

 

[RoyceyBaby]

Where do you turn on security auditing?

Thanks,

Royce

 

[jthiessen]

I believe it is AD users and computers and then the policies menu and audit.

Josh

 

[miggins]

Thanks for the help folks...
I am going to looking at the auditing side first.
Will keep you informed (just had some customer service talks.....)

 

[packdragon]

When that happened to my account, it was as ReddLefty said, I was logged into a few other servers and forgot all about it. After changing my password the repeated lockouts began because those servers with me still logged in it were trying to renew my ticket with the old password and failing. Perhaps a quicker way than auditing (though it's a good idea to have it on anyway) is to ask the user what machines they have been logging into, then checking to make sure that they aren't still logged into any of them.


- Just a little ol' MCP at Solien Technology
-

http://www.solien.com

 

[ReddLefty]

That's always the first question I ask my users when they just changed their password and they get locked out. 99% of the time they go: "Oh yeah.... I forgot about that machine..." ..

hehe.. Life of an admin.

 

[miggins]

Sorry about the delay but........
Still having problems, but now there are more users affected!
Tried all the ideas submitted (many thanks), still not working.
Put auditing on security, and watched a user.
When he right clicked his IE Icon it sent a request for authentication and locked him out.