Active Directory locks account

[jumpmaster82]

I have only one user effected by this, but as luck would have it, it is a "C" level. He will log in fine. Log out a little later, then when logging back in, gets "account locked out".

I have done this myself on his account (different PC), and it happens to me, so entering incorrect PW is not the problem (as I initially thought).

The AD locks the account after about 5 minutes of activity.

Any Ideas?

Thanks

DJ

 

[ciscorat]

Hi DJ,
I dont have a solution for you,
But I am experiencing the same issue,
I have several calls out to various resources, if you should find a solution please share with me,
I will do the same,
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
My user account locks out within a few minutes of
unlocking. This began happening once I changed my AD
password.
I am running in a mix mode(have domain PDC's and BDC's)
and also have Active Directory DC's, The user accounts in
the domain and Active Directory are NOT the same.
Event veiwers on the DC's provide little information as to
where I may have been logged on, or which server locked me
out.
Are there any tools or utilities that can help
troubleshoot this problem?

One possibility is that I am running a service using the
credentials of the previous AD user account and password
from before I changed my password.
Thanks
.

 

[jvierra]

Does the profile get unloaded correctly. I've seen this happen when the profile fails to unload because a process it still running such as a database network client processing a compoud query. If it logs in and out and the account is logged out then it "may" cause the account to become locked.

I suspect some trojan "scripts" might behave like this also.

When I saw this it I also had errors in the Event Log saying that the profile could not be unloaded because it was still in use.

Sometimes ( I would bet ) it could be caused by a faulting program. Check for this on logout too.

 

[Tekmazter]

When was the last time the user reset his password?

From a command prompt:

net user %username% /domain

If his password was set recently, I would look to see if this user has any other resources that he has mapped himself to manually. If this is the case, you need to disconnect from those resources manually. Also, make sure to ask if he has logged in anywhere else on the network recently and either mapped resources himself from that location, or if he still may be logged in elsewhere on the network.

 

[jvierra]

That is a good point - I don't think it works. Resources in the domain or it's trust wouldn't act like this. Of cource there could be a "big" in the software.

 

[jumpmaster82]

modified fix...
I got lucky and the user was fine with changing logon from flastname to firstL (first name/last name combo) and it worked out. I don't really have enough time to finsd the root cause, just needed to get it fixed.