My AD Account locks every hours 2

[windowsfan]

My AD account is getting locked out every one to two hours. I am not able to figure out the cause, I could not find the cause of it from Event viewer of my PC or DC.

Any help on how to figure this out and fix it.

 

[mrdenny]

This is typcially happening because:
1. Someone is trying to use your account.
2. Something is running under your account and you have changed your password recently. It could be a service, scheduled task, etc.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[windowsfan]

Thanks for the reply Deny.
I am almost positive that nothing is running under my account (no services). It's a same issue with the other user. How can I figure out if my account is being used for services or schedule task?

 

[astaylor]

you can check Services under Computer Management and see if your user account is listed anywhere under the Log On As column.

 

[Roadki11]

See if this can help you.

http://www.windowsecurity.com/articles/Implementing-Troubleshooting-Account-Lockout.html

RoadKi11

 

[windowsfan]

astaylor: I have already checked to make sure that that my account is not used to run any services, I also made sure that I do not have any disconnected session.

Roadki11: I have alockout.txt under c:\windows\debug, but I dont know how to figure out on what's locking my my account locked
Here's are the few entries from that file:
Files\LANDesk\LDClient\purgefile.exe,ALOCKOUT.DLL - dll_process_detatch
Fri Jun 29 08:54:06 2007, PID: 5920, Thread: 5148, Image C:\MSLock-out\LockoutStatus.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Fri Jun 29 08:54:29 2007, PID: 5920, Thread: 5148, Image C:\MSLock-out\LockoutStatus.exe,ALOCKOUT.DLL - dll_process_detatch
Fri Jun 29 08:54:37 2007, PID: 3756, Thread: 4228, Image C:\WINDOWS\system32\mmc.exe,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Fri Jun 29 08:55:27 2007, PID: 5916, Thread: 3432, Image C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH
Fri Jun 29 08:56:46 2007, PID: 4788, Thread: 5704, Image C:\WINDOWS\Explorer.EXE,***WNetUseConnectionW Failed!*** (5), Local: (null), Remote: \\, Password: Password was NULL, Window Title: , RC was: The network path was not found. (53), GLE was: The network path was not found. (53)
Fri Jun 29 08:56:46 2007, PID: 4788, Thread: 5704, Image C:\WINDOWS\Explorer.EXE,***WNetUseConnectionW Failed!*** (6), Local: (null), Remote: \\, Password: Password was NULL, Window Title: , RC was: The network path was not found. (53), GLE was: The network path was not found. (53)
Fri Jun 29 08:57:20 2007, PID: 5980, Thread: 4320, Image C:\WINDOWS\system32\NOTEPAD.EXE,ALOCKOUT.DLL - DLL_PROCESS_ATTACH

 

[markdmac]

More than likely you will find that you are logged in on a machine somewhere with an old password. When the machine with the old password tries to check in witht he server it sends an old password which will eventually lock you out.

You can use the Microsoft Account Lockout and Management tools to troubleshoot this. Free download at:

http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

Alternatively, The Spider's Parlor Admin Script Pack has a script to report lockout location. See link in sig...

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[windowsfan]

hi Mark,
if you check my previous post, I got those entries by using account lock out management tools, but cannot figure out anyhthing form that.

 

[NickFerrar]

Not sure what you're running to generate that log but I jsut use the account lockout tools GUI to find which DC the lockout occured on and then check the security log on that DC for the lockout event which should tell you what host the lockout happened which should be enough for you to figure out what's happening. If it's a desktop and you've checked for services I'd also look at mapped drives in case they were connected as the specific user (we occassionally have lockouts caused by manual mapping to Samba shares). If the lockout host is a server then check who's logged on it etc.

 

[markdmac]

getLockoutLocation.vbs : Reports what users are locked out at machines provided in a list file (wslist.txt)

http://www.thespidersparlor.com/vbscript.asp

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[windowsfan]

I was logged in to one of the server with old password. Logging off from that server took care of the lockout issue.

Thanks everyone.