5

We are running in a Windows 2008 / Windows 7 environment.

One on my users is being locked out of his Active Directory account on a daily basis. This occurs between 10 and 18 hours after each reset.

This just started last week.

I can see that the reason for the lockout is a failed number of password attempts. However, the user is not failing any attempts when he unlocks his system.

Therefore I am thinking that there must be a service, or some application, that has held on to his credentials (possible old?) and is trying to access the network in someway thus triggering the lockout event.

Are there any tools that I can use to tell me what computer these failed logins are coming from? Is there anything you can recommend to further troubleshoot this issue? It has become very frustrating.

Thanks!

3
  • 3
    Do you use Exchange Server? If so, does the user have a smartphone that may be trying to log on to their Exchange mailbox?
    – joeqwerty
    Nov 21, 2012 at 13:19
  • Good question -- we use a hosted Exchange provider with no connection to our Active Directory. Nov 21, 2012 at 13:24
  • 1
    How are your security settings set. How many logon attempts before an account will be blocked? Will the account be automatically reset after n minutes? You don't have to answer, but it gives you some inkling where the culprit would be coming from e.g. a job that runs every two hours means your password lockout occurs after 9 tries, ergo which jobs run every two hours on the client or on a server the person is responsible for.
    – John K. N.
    Nov 21, 2012 at 13:48

3 Answers 3

5

Rather than log-diving (as suggested by the other answer thus far), I prefer to use the Account Lockout Tools from Microsoft.

At the very least, it's immensely helpful in showing me which Domain Controller to go log-diving on.

(And yes, it does work on Server 2008 R2, even though it was originally developed for 2000 and 2003.)

2

On the Active Directory Server the users uses to logon with you will find an entry in the Security Eventlog.

The Event ID might be 4771 (Kerberos Authentication Service)

It might look similar to the following entry:

Kerberos pre-authentication failed.

Account Information:
Security ID:        DOMAIN/USERACCOUNT
Account Name:       USERACCOUNT

Service Information:
Service Name:       krbtgt/DOMAIN

Network Information:
Client Address:     ::ffff: **172.17.xx.xx**
Client Port:        59596

Additional Information:
Ticket Options:     0x40810010
Failure Code:       0x18
Pre-Authentication Type:    2


Certificate Information:
Certificate Issuer Name:        
Certificate Serial Number:  
Certificate Thumbprint:     


Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

The Client Adress line will inform you from which client/server the logon attempt came from. (in this example 172.17.xx.xx )

0

This is often a persistent network drive mapping using an old password (from another user's workstation perhaps).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .