W2K3 domain user gets locked out every 24 hours?

[mdcr1]

We have a user that got locked out of the network (couldn't access network drives, but for some reason could still send emails) at 5pm yesterday. We unlocked the account, reset the password, ran an anti-virus scan, didn't find anything. Today at 5:05 (24 hours after unlocking the account originally), user gets locked out again. Any ideas? A service that starts every 24 hours? This user says they weren't prompted to change their password in the last couple days either. We did have a DC go down four days ago and needed to transfer FSMO roles to a new server and add DNS to this new server as well, but no one else on the entire network (150 user) has experienced any issues like this. Thanks for any help you can offer in advance!

 

[intelwizrd]

Check the security logs on the DC to see if there is a job or service trying to authenticate against the account. It should tell you what machine the login is coming from as well.

 

[mdcr1]

Checked the event viewer and there is also an entry in the Application log that shows an error with an event ID of 1053, source of Userenv (Windows cannot determine the user or computer name, Group policy processing aborted) for the last two nights at around 5:00pm....

 

[cmeagan656]

Is there anything in this rather long link that might be pertinent to your situtation?

http://eventid.net/display.asp?eventid=1053&eventno=1584&source=Userenv&phase=1

Hope this helps.

Please help us help you. Read Tek-Tips posting polices before posting.
Canadian members check out Tek-Tips in Canada for socializing, networking, and anything non-technical.

 

[mdcr1]

I had checked that link previously, and we went through and cleaned up AD by removing the old server and adding the IRPStackSize registry key on that problem computer/user's computer. On the new server, we did find an error & warning specifically mentioning that problem user at the same time as they were getting locked out, and eventid.net referenced the fact that one of the DCs might have old information on it...still don't know why it's only at 5pm that it's happening, but we will see if any of the things we did today have fixed it shortly

 

[mdcr1]

that day was the last day this error happened, we ran NTDSUtil.exe tool to manually remove the dead server from AD and then forced replication for all the other servers. At 5pm that next night, the user did not get locked out, and hasn't since. Every now and then, we'll still get a machine that can't log on, saying "the domain could not be contacted" but we've ended up logging in off the network, plugging back in the network cord, then flushing and registering the dns in the IPCONFIG command, so it may still have some network issues, but for the most part, we've resolved that original problem...Thanks!