2

Continuous account lockout error for a domain user in Windows server 2003 DC. Tried the account lockout and management tool and using the Lockoutstatus.exe I could get the details of client system name, reason ( Bad password) etc and verified the same by checking windows server security logs. The client OS is Windows 7 64bit and Alockout.dll is not compatible with Windows 7.

I tried the following steps.

  1. Cleared the credential manager.

  2. Unmapped the network drive.

  3. Verified that the user only login to domain from his PC ( Single session )

  4. I did a full antivirus scan and Windows malicious removal tool .

  5. Installed all Windows updates.

    I think some services may use his domain username for connecting to the network but I need to find out which service / program trying the wrong password. Is there any way I could get the logs for the same ( I also checked the Windows 7 security logs but no information about the bad password etc) Any help would be appreciated.

Regards, JK

4 Answers 4

1

A few random thoughts:

  1. Enable auditing of logon/logoff events on the client, and/or;
  2. Use Microsoft SysInternals Process Explorer and Process Monitor to monitor and investigate processes and what credentials they are using. Process Explorer, for example, shows you the credentials used to launch a process, but you can also drill down and investigate credentials being used through impersonation (enable the lower pane view, set the lower pane to show handles, and then look for Token objects)

That's where I'd start...

1
  • Thank you, I used process explorer and I could see the process and services are running under the domain user. But I couldnt see the token objects (enabled lower pane view and set lower pane to show handles). In the services.exe there are no services logon as the domain username.
    – techiyan
    Jul 25, 2013 at 17:01
1

I would also run netlogon service and review its logs. Also you can check out netwrix. They have a program call Account Lockout Examiner, with this program you can view the account on what ever workstation that they have logged into. Oh and another point is: does the client have two NIC's? The reason why I ask is that I was having an issue with a laptop doing the same thing. They were both hitting the DNS for authentication at the same time, which caused our lock out issues on our end.

Account lock out examiner

Starting nelogon

0

I'm pretty sure I agree with @SimonCaitlin in your approach. Proces explorer could be a quick win for you. I just thought I'd add the following additional ideas.

You have two potential sources of this problem, the system or the user.

The system could possibly be trying to run a service in the context of that user. This should be listed in the services.msc console. Or you could try disabling services and see when the lockout stops happening.

If the lockout is happening when a particular user is logged in, then you can safely say its a process run by that user that is causing the lockout. If you have cleared credentials, disconnected drives, etc., you could try replacing the user's profile with a new one.

Oh, and Scheduled Tasks is another potential source of failed authentication requests from both a computer and user perspective. It could be a task configured to run in that user's context, or a script that is run which uses stored credentials by some other means, which is trying to authenticate with the domain controller. This has happened before and the regularity of lockout time was the giveaway.

3
  • Thanks .The lockout is happening when the domain user login to the PC. In fact he is only the user login in the PC. The stored credentials are Outlook's login. I cleared it and even after, the lockout happened. Is there any we can get the logs of which service or process is trying the bad password ?
    – techiyan
    Jul 25, 2013 at 17:03
  • @techiyan, did you try checking scheduled tasks for tasks which run as that user. Failing that a new user profile would be one to try.
    – john
    Jul 25, 2013 at 17:53
  • 1
    Hi, No scheduled tasks for the user. Is there any to client logging. I heard that in Windows 7 its not possible.
    – techiyan
    Aug 3, 2013 at 18:03
0

Is there only one DC in the domain? Do you have access to the DC(s)?

Things to check:

  1. Programs that use AD creds.
  2. Persistent drive mappings.
  3. Scheduled Tasks.
  4. Disconnected RDP/TS Sessions.
  5. Outlook and Outlook Web Access
  6. Mobile email apps (If you're using something like Lotus Domino w/ Traveler for email for example)
  7. Wireless settings (If you're using user authentication for wireless)
  8. Services running as user.

Using the LockoutStatus.exe you can see which DC(s) are getting the bad password attempts. Use EventCombMT.exe to analyze them for you:

For EventCombMT:

Double click "EventCombMT.exe" and click the "Searches" drop down menu then "Built In Searches" then "Account Lockouts". What this is going to do is pre-populate some of the search criteria for you. It is going to get a list of your domain controllers, check off the "Security" log box. Check the boxes for "Success & Failure Audits" and lastly it is going to populate some of the "Event IDs". (Note: Add the following Event IDs to the search line: 4625 4740 if you have Windows 2008 DCs)

You can also use the SysInternals Process Explorer and Process Monitor as others have said, but that will only help you if the issue is on the machine you're running it against. If the users credentials are elsewhere - the above steps will help.

1
  • Thanks. No drive mappings,Programs that use AD records ( I could see some programs are running under the domain user using process explorer.However I didn't give domain login creds explicitly),No RDP sessions ( Lockout because of bad passwords),Outlook ( Outlook got a different credential. I cleared it and checked. Still lockout happens), Mobile email apps (not using any),wireless settings ( Yes. its a laptop user and using wifi. so can not be avoided ),No services running as this domain user. Yeah, I know the DC and system using the Lockoutstatus.exe.
    – techiyan
    Jul 25, 2013 at 17:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .