Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an AD user account which cannot be unlocked, AD is running on Win2k3.

I can uncheck the "Account is locked out" check box and click Apply then OK, but the next immediate moment when I open the property dialog the account is still locked.

I changed the group policy on Windows Settings > Security Settings > Account Lockout Policy > everything undefined. But the account stil gets locked out.

There could be an improper shutdown of the client computer the last time it was used.

What could be wrong? Thanks for advice.

EDIT: Following Chadddada's advice, I created a .bat file to execute the commands and simultaneouly hit the "enter" button on the client computer login screen --- i'm logged in now!

But checking back in AD, the account is still locked out! I don't think there is any machine set to "brute force" that user account with random passwords. Any idea why it would auto lock out?

EDIT (Update): Checking in the Event Viewer > Security logs, the prime suspect is

Pre-authentication failed:
    User Name:  lesliet
    User ID:        COUNTRY\lesliet
    Service Name:   krbtgt/COUNTRY.COMPANY.COM
    Pre-Authentication Type:    0x2
    Failure Code:   0x12
    Client Address: 192.168.xxx.yyy

192.168.xxx.yyy is actually our secondary DC running AD on Win2k8.. But this is beyond what I know already. Any more help is greatly appreciated!

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

I've seen this before when someone has a stored account credential (on let say an IPAD) that logs them into their email. This will try every so often to sync the account (like every 30 seconds to poll) and it will lock the account out. See this Microsoft download link for account lockout tools and a whitepaper on troubleshooting account lockouts.

UPDATE:

Exchange is simply an example. It could be something as simple as being logged in to another workstation after a password change. In your case the problem is a policy restriction. Following the steps in the whitpaper will show you how to use the netlogon.log files and tools to track down the workstation causing the problem

share|improve this answer
    
Yeah I have seen that also on multiple devices. I would check for failed login attempts around. –  Chadddada Jun 14 '11 at 3:51
    
we are not using Exchange so that possibility is completely ruled out. I just don't see any other device logging into the account. Please see update on question. Thanks. –  Jake Jun 14 '11 at 5:33
    
@Jake, exchange is an example. See the update to my answer –  Jim B Jun 14 '11 at 12:43
    
I think you might be closest in this case. The only other workstation the user was logged in during the improper shutdown was via RDP on the user's personal workstation. My first steps however, were to change the user id to prevent the log out, log in and out of RDP, change username back. problem did not come back again. but i would not have thought improper disconnection of RDP can cause password conflicts, it's strange but i cannot explain otherwise. –  Jake Jun 15 '11 at 1:04
    
the whitepaper link on MS site was broken when I checked yesterday. Only now, I see a second link on the site which is working. thanks. –  Jake Jun 15 '11 at 1:06
add comment

You are doing this from a domain admin account that is able to modify AD (I know silly question)? Have you tried logging in with the account that seems to still be locked?

I would also double check via cmd that its locked: NET USER loginname /DOMAIN | FIND /I "Account active"

Try to unlock it: NET USER loginname /DOMAIN /ACTIVE:YES

Or toss in the reset password also: NET USER loginname newpassword /DOMAIN /ACTIVE:YES

Just some things to try.

share|improve this answer
    
C:\Documents and Settings\admin>net user lesliet /domain /active:yes The command completed successfully. C:\Documents and Settings\admin>net user lesliet /domain | find /i "account active" Account active Yes C:\Documents and Settings\admin>net user lesliet /domain | find /i "account active" Account active Locked –  Jake Jun 14 '11 at 2:19
    
That's what is happening. Strange!! –  Jake Jun 14 '11 at 2:19
add comment

Check the sever security logs to try and determine from which machine the logon attempts are being made.

I suspect what you're seeing may be the result of a virus or other malicious software. I've seen this happen before where the undesirable software is using brute force to try and access the account. No matter how often you unlock it, within seconds it's locked again because there were attempts to use it with incorrect passwords. In such a case the server is of course doing exactly what it's supposed to - lock the account.

share|improve this answer
1  
That or what Jim B mentioned before, stored credentials on a device. I have seen the iP** devices locking accounts all the time. –  Chadddada Jun 14 '11 at 4:05
    
I checked the event viewer (not sure if that is where I should check) and I got the suspect. Please see edited question. Thanks. –  Jake Jun 14 '11 at 5:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.