Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've been troubleshooting this problem for two years and it keeps coming back. Our Mac users authenticate to our Active Directory server which is running Windows Server 2008 Standard. One of the Mac users in particular has had a recurring problem where she can't log on and causes her AD account to lock before the maximum log-in attempts has been reached. The problem started again two weeks ago and I reconfigured her networking and Active Directory settings. I thought I had the problem fixed but last week I was in the office early and decided to install Mac updates which required a reboot. When the user tried logging in twenty minutes later, her account was locked. Her security log shows this message, "authorizationhost[96] Failed to authenticate user (tDirStatus: -14090)."

This happened again this morning even though I didn't do anything to her computer and she tried logging in 1.5 hours after the computer turned on.

This also happened after I have successfully logged with her ID and password only to have the account lock after I've logged out.

The only thing I can think of that it's trying to connect to is LDAP on our AD PDC, but I've never entered any credentials and no one else has this problem.

All Macs have Snow Leopard 10.6.7 and they all have the same network and AD settings, but this particular Mac continues to have a problem.

share|improve this question
    
Just to update this, it turned out to be a keyboard problem. For some reason the right shift key would not work in the log-in panel so when she put in her password which had a capital letter, it would not accept it and would eventually get locked out. One day she logged in using the left shift key and all was good. After logging in the right shift key worked normally. It just occured to me that this doesn't make sense because I was able to log in using her keyboard with no problem. Anyway, she now has a new computer with no problems. –  Kent Mar 24 '12 at 1:46

5 Answers 5

So, if I read this correctly, you've never witnessed this yourself and it continues to happen. Sometimes, immediately after you leave? Is it possible that the user is problematic and can never remember her password? Have you looked in the console to see exactly how many failed logins there are?

AD won't lock an account unless it has failed x number of times over x minutes (set by your password policy). If there is no automated/saved process on the Mac causing this, then all that's left is the user.

share|improve this answer
    
Changes are, it's something going berko and over-authenticating - Outlook used to do this on Windows. Microsoft recommends account lockout values between 10 and 50 guesses; if you set the lockout duration to only one minute, it won't massively impact the user if they're just casually getting it wrong. Troubleshoot wih EventCombMT. support.microsoft.com/kb/824209 to find out what's triggering the event. –  TristanK Jun 2 '11 at 0:55

It could be that she has an old or incorrect password stored in Keychain. This could be associated with an application, web page or process, which when invoked, causes the account to lock. I would suggest checking this and deleting any entries from her Keychain that contain your AD credentials (or even any that look like they do).

I had a similar issue with a user a few years ago. His account kept 'randomly' locking. We had a 30 day password expiry in that company, and he'd set up his Exchange mail account on his iPhone. He changed his password when prompted, but his iPhone, still using the old credentials, would lock his account every time it tried to fetch mail.

share|improve this answer

I don't have any knowledge of how osx works with ldap but when I have strange problems with osx I can normally get a clue by running plutil You can try to find any errors in the plist files for the user in ~/Library/Preferences inside that directory you can run plutil -s *.plist this should report any errors in those config files. You can do the same in the systems library. Good luck.

share|improve this answer
  • Is it possible the user set up a different mail client or other tools that might be trying to authenticate?

  • Or could there be a citrix or RDP session alive on a remote system?

  • Can you give her a different Mac to use for a while so you can determine whether its the Mac or her account

share|improve this answer

The two main causes I see of accounts being locked out, other than the obvious one of the user entering the wrong password, are:

  • Virus/malware (could be on any machine) attempting to access the account using brute force. This should be apparent in the Windows server event logs.
  • Accessing a shared resource using an old password. This is particularly common when using non-Windows machines to access Windows resources with remembered credentials.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.