Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an an account which is being periodically locked out on our network (once a day roughly).

We use active directory, with multiple domains, spread across hundreds of servers.

How can I find out on which server this account is being locked out on?

I'm guessing there is a scheduled task which is being run, where the password hasn't been changed.

share|improve this question

3 Answers 3

up vote 7 down vote accepted

Microsoft provides some great add-ons which can help quite a bit with this. Here is a lint to those tools: Account Lockout and Management Tools

and here is some articles on how to use the tools: http://technet.microsoft.com/en-us/library/cc738772.aspx http://www.windowsecurity.com/articles/Implementing-Troubleshooting-Account-Lockout.html

The one which would probably be most helpful is the LockoutStatus.exe, as it will find all of the domain controllers in your forest/domain and return to you that last time in which there was an unsuccessful login attempt. It will also tell you if the account is locked on that DC, and provides you the ability to unlock at that site.

share|improve this answer

My first action would be to enable security loggin for failed logon and attempts on the domain security policy, this may give you some insight into what is causing the lockout.

share|improve this answer

It's either a scheduled task, the account is being used for a service on some machine, or the person has logged onto another machine and locked it, and is still logged on and locked, under the old credentials.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.