General discussion
-
Topic
-
Windows Admin account Lockout
We have 6 DC’s. I constantly see that I am having account lockouts happening and it is so frustrating. I logon to these domain controllers which is a mix of 2008/2012 and 2003. I look for 4771 event IDs and 529 Event IDs. I do not see anything with my logon name. Once or twice I found and I traced the source ip address to be my desktop and I rebooted it. But, now I still see that it is locking my account every day at either 3am in the morning or 6am or 4:03 pm and during weekends on Saturdays and Sundays. I am lost and I am not sure what else I can look for. I know I am not able to get the tools from my company other than the free lockout status tool. This is frustrating. How can I trace it to the root cause where this is occurring.
Appreciate anyone who has some kind of way to find out why it is getting locked out.
