1

Around the end of February, the password was about to expire on my Active Directory account.

So, I changed the password.

Since then, I can get locked out 3 to 10 times a day without me doing much of anything on my end. It can even happen when I lock the PC and step away to the restroom or while I am in the middle of writing code in Visual Studio.

Our network admin has been working with me to try and resolve this (he's tired of unlocking my account), and all of the bad password attempts originate from my PC.

So, I got to looking into certificates, and I noticed I have two (2), one of which has recently expired.

certificates

I started to delete the expired certificate, but Windows warned me that any data encrypted by me using that certificate would be non-accessible once the certificate was deleted.

How do I update an expired certificate?

How do I tell what data a certificate has deleted?

Could this expired certificate be causing my Active Directory account to get locked out?

7
  • 3
    No, it's probably nothing to do with the certificate. It's probably when you changed your password, you have some service or scheduled task on some machine somewhere that is still trying to function by using your old password.
    – Ryan Ries
    Mar 28, 2013 at 18:28
  • You should go thank your network admin for being so understanding. I'd have given you to the end of the day to figure out where the account lockouts are coming from (and no, it's not the expired certificate), and re-imaged your machine if you couldn't. Mar 28, 2013 at 18:51
  • I don't even see an expired certificate... Mar 28, 2013 at 19:07
  • @DennisKaarsemaker He's got the wrong one circled, but the bottom one has an expiration date of 2/6/2012. I think that one might be expired. Mar 28, 2013 at 19:13
  • LOL - you're right. I thought it said 2013, not 2113. The Token Signing Public Key is still expired, though.
    – jp2code
    Mar 28, 2013 at 19:13

1 Answer 1

3

No, expired certificates have no role in AD authentication (by default). Especially certificates in Chrome, which has no Windows-auth hooks at all.

What's much more likely is a service or scheduled task on your machine that's configured to impersonate you and never got the password change supplied. This service/task then runs every so often, attempts to authenticate, fails, and you get the lockouts.

You can fairly quickly look up if you have such a service configured by opening Computer Management, navigating to the Services section, and sorting the list by Log On As; if you're on any of 'em, right-click properties and enter your new password.

5
  • ...or printer, or drive mapping, or... well, yeah, lots of possibilities, and they're a pain to track down. Mar 28, 2013 at 18:49
  • Multiple Services under Computer Management, all are logged on as either Local Service, Local System, or Network Service. Which one am I? Local Service? The Local Service shows a Password and a Confirm password, but the current data is hidden (naturally).
    – jp2code
    Mar 28, 2013 at 19:11
  • @jp2code No. The lockouts are coming from something that's using your username and old password. Probably fastest to blow away any mapped printers and drives and remap them with your new credentials. At least 9 out of 10 times, that's the problem. Mar 28, 2013 at 19:15
  • All of our mappings are controlled by a script in the Group Policy. However, I see one that has a Red X on it, so I disconnected from that. It'll reconnect the next time I log in, though. Fingers crossed!
    – jp2code
    Mar 28, 2013 at 19:20
  • Any other ideas? I still get locked out daily. I can add that Outlook keeps poping up a Security Alert saying our Exchange Server has an invalid security certificate. I wonder if that could be causing this.
    – jp2code
    Apr 4, 2013 at 12:59

Not the answer you're looking for? Browse other questions tagged .