User account lockout

[tperachio]

Has anyone seen this before:
I have 1 user account experiencing this problem, her account gets locked out, I've watched her log in and she does everything right, i've tried logging in her account with her user name and password and it seems she just gets locked out. it will happen even while she is logged into her account, she is the only user experiencing this problem, i've re-built her pc, i deleted her account and re-created the account and it still happens, i just don't know what might be causing this. Really need help with this.

 

[ITPangaeaArchitect]

an application somewhere is caching her old credentials
possibly mapped drives using old creds

gerenally its one of the two...but occasionally security scanners creep up and lock out accounts (i've worked some massive account lockout issues thanks to security scanners)

whats your account policy settings? (account lockout threshold, etc.)

-Brandon Wilson
MCSE00/03, MCSA:Messaging, MCSA03, A+
almost got a paragraph there

 

[Stevehewitt]

Have you checked your DC security logs? Maybe there is a collegue playing about? Trying to logon using her name to lock it out on purpose?

 

[lkd]

Tperachio...have you ever resolved what was going on? I am having the same problem with my personal account...neither campus nor district tech can figure out what is going on.

Thanks!

 

[Roeee]

Maybe worth checking the directory service event logs on a DC. This should indicate when and possibly why the account is locking out.

I have seen this problem before but had trouble pin-pointing the cause. The logs did however point me in the direction of the source machine causing the lockout.

Also, this lockout can be caused by a timing issue within the domain. IF you change your password, one DC may know the new password, but with a time and possibly a replication issue the other DC's know only the old password. This can cause a confilct which locks an account.

 

[Stevehewitt]

Yeah - the logs should be the first port of call.
As mentioned above, things such as security scanners and mapped drives (seen loads of these) are often a problem.
(shared admin accounts across IT tech's who when we change the password it keeps locking out - as we've used it for services and for mapped drives whilst testing / playing etc.)

Check the logs and see what they say.

Ta,



Steve.

"They have the internet on computers now!" - Homer Simpson