Domain user continously gets locked out...Help

[Newb2IT]

Hello, I have a user that is using Vista Business SP1, every few hours his domain user accounts gets locked out for no apparent reason, he has to call tech support every 4 hours or so to ask for his account to get unlocked, no other users has this issue (he is the only user with Vista). We have a Windows 2003 Domain Controller. Is it possible that a program in his computer is authenticating to the server with wrong credential? what could be causing this problem? where can I look to see whats causing the problem. This would be huge if you can help. Please give me some ideas or tips..I went to the server and did a search for the users name and computer name in the security log but I did not find anything

thanks so much

 

[alfa2008]

If he uses any mobile device for mail synchronization, it is possible he has changed password in PC, but not in mobile device. For example, mobile I use for mail sync can be set to do sync every 4 hrs. I have many this kind of issues when people change their passwords in PC, but they are not aware they have to do it in their mobile devices as well, and their passwords get locked.

 

[Newb2IT]

We do not have an Exchange server, so I guess that means that his Blackberry is not the issue right? We use POP3 email.

 

[ADB100]

On an unrelated forum I heard a couple of people complaining about the '2fconficker.b' virus which was locking user accounts. Not sure if that's it, but something to check anyway.

Andy

 

[Newb2IT]

We do have anti-virus and this users computer is only 3 days old.

 

[Davetoo]

POP3 users username/password, so yes, if he plugs in the wrong one or old one, then it will lock out the account.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Zelandakh]

Turn on auditing of unsuccessful logons which may help you isolate if it is on that machine or not.

Then check the software installed on that box.

 

[Davetoo]

This is so strange...I swear I responded to this thread on Friday...but it wasn't posted until Saturday? Weird...anyway, I thought I'd responded already to check your servers security logs. They should point you towards the source of the lock outs.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Davetoo]

Oh good, I'm not losing my mind...the OP cross posted into the Vista forum, which is where I answered with the security logs.

Unfortunately cross posting is something I detest, so I will bow out of any further participation in this posters threads.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[Newb2IT]

Dave I only cross posted because it was suggested by another expert. Sorry