General discussion

Locked

User account randomly locked out daily

By mhudson160 ·
Here's the rundown:
XP sp2 on workstation. Windows Server 2003 AD environment.

User gets account locked when she either 1. logs off her pc or.... 2. Closes Outlook 2003.

When we unlock her account, if she stays in Outlook or does not logout of her pc she's ok. Yesterday we had her remain out of Outlook. When she arrived this morning and logged back onto her pc she was locked out.

We have done the following (not in order):
- recreated her AD account and mail file after saving her mail and other settings
- setup a newly imaged pc for her

We have 300 users and she is the only one with that issue. We have two other people here with the same last name but their login id's are different (different first initials).

Has anyone ran into this before. Thanks for any help!

This conversation is currently closed to new comments.

12 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by -Q-240248 In reply to User account randomly loc ...

Check the AD event viewer for errors associated with her account.

Collapse -

by curlergirl In reply to User account randomly loc ...

Does the same thing happen if she logs on to a different workstation? Does she run some software or service on her workstation that other users don't? Is there some kind of script running at logoff? I'm thinking in the direction of some application or service that runs in the background that is using her credentials to connect to the server but has the wrong password information. Could even be some sort of spyware or Trojan running on her machine.

I'd check the event logs on her workstation for errors at logoff.

Collapse -

by sgt_shultz In reply to User account randomly loc ...

well i havent' run into it personally but it is a well known issue from what i can tell from the mskb at support.microsoft.com
the scariest reason is somebody hacking with her account...
but you setup a new one, so that MIGHT rule that out.
are you using group policy to set the account lockout
outlook is also known for logging repeatedly and can make the account excede it's bad attempts threshold
here is a pretty good article on tshooting logout problems. if me, i'd start by updating xp client and win2k3 server with all the service packs and critcal updates.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx

Collapse -

account keeps getting locked out

by helen.makara In reply to

I had the same problem happen with my account. Which I am Domain Admin, so this was starting to really bother me. During my research of the problem i discovered that one of my servers was trying to authenicate to the DC with my account. I did not have any service running, proxy setting, scheduled job running. This was a front end server for exchange. I ran the utility WINMSD from the STart/Run prompt. Searched for my user name. I discovered something very ODD. There was a program listed under "Accessories" with my Username!!! When I would look for the program, i could not find it. So I deleted my entire profile from this Server. Oddly enough my account did not get locked out after that. This could of been a worm/trojan or something.

Collapse -

Having the same problem!!!

by nvguzman10ym In reply to User account randomly loc ...

I have the same problem. But mine is affecting a lot of users. I'm getting a mixture of 644 and 539 Event log IDs. If you have found a solution, please email me "nvguzman10ym@yahoo.com.ph". Thank you!!

Collapse -

Having the same problem!!!

by bcgomes_rj In reply to Having the same problem!! ...

I have the same problem.If you have found a solution, please email me "bcgomes_rj@yahoo.com.br". Thank you!!

Collapse -

Locked out account

by johnlenssen5 In reply to User account randomly loc ...

Try Account Lockout Examiner from www.netwrix.com
Probably it will report why the account randomly locked out.

Collapse -

by xhaner In reply to User account randomly loc ...

I had same problem ...
Here is solution :
Your MS Outlook has Network Logon Security option : like KERBEROS/NTLM Password authentication but its not using KERBEROS just NTML thats why you are generating Bad Password Count. You have to make it using Kerberos .(When you check Event Viewer logs from Exchange server you will see that ,[username] event 540 , is using NTLM network logon authentication not Kerberos.)
You can switch it at MS Outlook -> Mail Account -> More Settings -> Security . ( i didnt try this but possibly it would work)
But I have fixed it by using a script which i downloaded from : http://www.microsoft.com/downloads/details.aspx?FamilyId=7AF2E69C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en extract to any folder and run EnableKerbLog.vbs -> click ok
restart yout pc and its all .Its Enables Kerberos.

See you ...

Collapse -

Could be the problem resolution

by vksohpaul In reply to User account randomly loc ...

1) Try to check if IUSR (Internet User) is given access on the Anonymous user account in IIS on the machine you are trying to connect which could lead to the account unlocked. I had the same problem and found out that whenever my system tries to connect to any web portal on a server in our domain, it kicks my account out and lock it. We later found that IUSR - Anonymous access was removed from the IIS Server and we restored it back. We also checked the Windows authentication flag to on.

2) There could be a possiblity that a service under domain user account is running which is trying to log in to a resource on the domain on frequent intervals and on frequent login attempt failures, Domain controller locks your user account

3) Possibly a virus threat so read the System Security Events carefully to track the problem

Collapse -

User Account randonly locks out on different workstation

by ajr_63 In reply to User account randomly loc ...

My problem is that a user account randonly locks out but on different workstations that user has not log on. The event log on AD shows users locked out every 10-15 minutes. No services are running on this account. Last thing I did before this issues started was to install Sp3 on users workstation.

Any solutions?

Back to Networks Forum
12 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums