account locking

Status
Not open for further replies.

Guinness133

Solid State Member
Messages
12
I've got a user at work whos AD account keeps locking out. It's not everyday, but rather 2-3 times a week. He is not logged in to any other workstation but his own. Something is trying to use an old password of his over and over. When I look at the Account Lockout Status software, I can watch the bad password count rise.
Any suggestions would be greatly appreciated. Thanx!!

Cheers!
-Brian-
 
Anyway to trace if it is from a internal address on the network? Sounds like the pc could have been infected and someone got his old password. Then using that to try and access the network. Could have the potential for something bad.

Cheers,
Mak
 
Open the Event Viewer>Security

You should see Failed Attempts with the username and name of the computer with the domain, etc.

This only works if you name the computer other than something random.
 
I can't imagine how a third party application can report a failed authentication but the server's logs don't.
 
I don't know either, but there are no failed attempts in the event logs, and the account is still locking. I think I'll throw myself out the window. haha
 
Is there any software on his account that uses Network access to do certain tasks. It could be that he failed to update said software with the new password which is why you get the bad password failure count to rise so much.

Something like a Networked drive the the user has access to? Could be that the setup of that is out of date and not updated which might be causing this issue as well.

Just a thought...
 
Status
Not open for further replies.
Back
Top Bottom