Windows Forum

Ask something
Discussion Locked

User account locking out randomly

0 helpful
9 replies

by Member 23567752

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a user who's network account is locking out randomly (Windows NT domain, XP workstation)

Indications are denial of printig services/exchange etc. When I check account via user manager on the server, the account has been locked out.

I'm confident the user is not mistyping the password, and the password has been set to never expire. Additionally, on occasion, the lockout has "fixed" itself, returning all services back to normal.

Has anyone seen this before, or have any advice on where to troubleshoot (I'd like to avoid creating a new user account).

9 replies

by joseph moore

Check if the user account is set to run a Service. Remember, you can specify what account a Service should run as. Perhaps one Service is set to use the user account, and the password is set incorrectly for the Service. Then when the Service runs, it has the wrong password, so an incorrect login event is recorded. After a couple of tries, the user account is locked out.

Also, check the Scheduled Jobs for the same thing.

These are why this happens. I have seen this many times.

hope this helps

by Member 23567752

Thanks for tips! I eventually tracked it down to the MSExchange Pop3 interface, which was logging on with a bad passoword

by kevin203

I experience it before that whenever i unlocked the user and it will locked again when the user try to login thru his/her workstation.

Did you try to reset the user password and try to login again from the workstation.

Tracking the error thru Event Viewer is important too.

Try not to set the password to "never expire".

Thanks

by rabbit_runner

Check something else.
Has this user recently changed their password? Probably the answer is yes.
Next, has the same user logged on to another workstation and failed to log out? Check other systems that are not widely used, or are in a test environment.

Also, as in above, check to determine if there are any services which have been set with this users account credentials.

Something on the network is attempting to use this person's account information. You need to locate where this is happening. I have always seen this problem when the user has just recently changed their password. Then, whatever is using their account, does not have the correct password. Thereby causing the account to become locked. Check your network for another computer logged in with this user's account, a service which is being administered with this user's account, and perhaps a software package which requires the user's account.
You now have some searching to do.

Best of luck.

by curacao_dejavu

Enable auditing on your domain.
which is located in, user manager for domains, policies, audit.
select alll of the faillures, and from success options 4,5,6.

You would be able to see from which machine they are trying to login and proceed from there (could be a user or process or program).

Leopold

This discussion is closed to new replies.