Answer for:

I have a user (XP pro) who gets locked out of her account every day.

Message 27 of 49

View entire thread
0 Votes

A user who "forgot" they had logged on to another computer, failed to logoff AND had changed their password in the interim has been my most common cause of this issue. Usually they only "remember" after you find the offending workstation.

Check the Domain Controller security logs to find what may be a 529 error or a Kerberos error 0x18 and may have the user's ID in it. That will yield the IP address of the station that is trying to authenticate with a bad password and triggering the lockout.

Another possibility is the user mapped a persistent static drive with their credential while another user was logged in on another machine - and subsequently changed their password.

Again back to the Domain Controller security logs to find the offending IP.