Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have account which keep locking out every few mintues in AD.

I'm using Windows 7 Enterprise X64 PC I'm using Windows 2003 STD server

These are the things i have tried.

  1. Created new profile.
  2. Removed all printers and mapped drivers.
  3. Used tool from microsoft ALtool ( I can't seem to find the log file under. c:\windows\debug).

Normally it should say in log files where the account is being lock but it doesn't say anything as you can see below.

These are the log files i have from my DC.

675,AUDIT FAILURE,Security,Thu Oct 20 09:17:26 2011,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name: username     User ID:  %{S-1-5-21-284166382-85745802-1543857936-28692}     Service Name: krbtgt/domain     Pre-Authentication Type: 0x0     Failure Code: 0x12     Client Address: ip address     Certificate Issuer Name: %7     Certificate Serial Number: %8     Certificate Thumbprint: %9    
644,AUDIT SUCCESS,Security,Thu Oct 20 08:24:17 2011,NT AUTHORITY\SYSTEM,User Account Locked Out:     Target Account Name: username     Target Account ID: %{S-1-5-21-284166382-85745802-1543857936-28692}     Caller Machine Name:      Caller User Name: DC SERVER$     Caller Domain: domain     Caller Logon ID: (0x0,0x3E7)    
644,AUDIT SUCCESS,Security,Thu Oct 20 08:21:46 2011,NT AUTHORITY\SYSTEM,User Account Locked Out:     Target Account Name: username     Target Account ID: %{S-1-5-21-284166382-85745802-1543857936-28692}     Caller Machine Name:      Caller User Name: DC SERVER$     Caller Domain: domain     Caller Logon ID: (0x0,0x3E7)    
644,AUDIT SUCCESS,Security,Thu Oct 20 08:16:55 2011,NT AUTHORITY\SYSTEM,User Account Locked Out:     Target Account Name: username     Target Account ID: %{S-1-5-21-284166382-85745802-1543857936-28692}     Caller Machine Name:      Caller User Name: DC SERVER$     Caller Domain: domain     Caller Logon ID: (0x0,0x3E7)    
644,AUDIT SUCCESS,Security,Thu Oct 20 08:13:10 2011,NT AUTHORITY\SYSTEM,User Account Locked Out:     Target Account Name: username     Target Account ID: %{S-1-5-21-284166382-85745802-1543857936-28692}     Caller Machine Name:      Caller User Name: DC SERVER$     Caller Domain: domain     Caller Logon ID: (0x0,0x3E7)    
644,AUDIT SUCCESS,Security,Thu Oct 20 08:09:25 2011,NT AUTHORITY\SYSTEM,User Account Locked Out:     Target Account Name: username     Target Account ID: %{S-1-5-21-284166382-85745802-1543857936-28692}     Caller Machine Name:      Caller User Name: DC SERVER$     Caller Domain: domain     Caller Logon ID: (0x0,0x3E7)    
675,AUDIT FAILURE,Security,Thu Oct 20 07:50:08 2011,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name: username     User ID:  %{S-1-5-21-284166382-85745802-1543857936-28692}     Service Name: krbtgt/domain     Pre-Authentication Type: 0x2     Failure Code: 0x18     Client Address: ip address     Certificate Issuer Name: %7     Certificate Serial Number: %8     Certificate Thumbprint: %9    
675,AUDIT FAILURE,Security,Thu Oct 20 07:50:08 2011,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name: username     User ID:  %{S-1-5-21-284166382-85745802-1543857936-28692}     Service Name: krbtgt/domain     Pre-Authentication Type: 0x2     Failure Code: 0xE     Client Address: ip address     Certificate Issuer Name: %7     Certificate Serial Number: %8     Certificate Thumbprint: %9    
675,AUDIT FAILURE,Security,Thu Oct 20 07:49:59 2011,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name: username     User ID:  %{S-1-5-21-284166382-85745802-1543857936-28692}     Service Name: krbtgt/domain     Pre-Authentication Type: 0x2     Failure Code: 0x18     Client Address: ip address     Certificate Issuer Name: %7     Certificate Serial Number: %8     Certificate Thumbprint: %9    
675,AUDIT FAILURE,Security,Thu Oct 20 07:49:59 2011,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name: username     User ID:  %{S-1-5-21-284166382-85745802-1543857936-28692}     Service Name: krbtgt/domain     Pre-Authentication Type: 0x2     Failure Code: 0xE     Client Address: ip address     Certificate Issuer Name: %7     Certificate Serial Number: %8     Certificate Thumbprint: %9    
share|improve this question

migrated from stackoverflow.com Oct 20 '11 at 13:59

This question came from our site for professional and enthusiast programmers.

    
They are no cache passwords on PC and I have check all the PC which user have logged in, in past. –  user630320 Oct 20 '11 at 9:13
    
StackOcerflow is a programing stack Exchange, you'll get better audience asking your question in ServerFault. –  JPBlanc Oct 20 '11 at 12:15
2  
Has the user logged in elsewhere? Is there something sitting on the keyboard? No joke, have had this happen. –  Ben Campbell Oct 20 '11 at 14:06
    
Does the user have a smart phone that automatically logs in and checks email? This may be using an old password. –  jftuga Oct 20 '11 at 14:36
    
User has desktop pc and laptop but he only use one of them at a time. no smart phones –  user630320 Oct 21 '11 at 10:52

3 Answers 3

Your Kerberos failure codes explained:

0x18 - The account is locked, is outside the logon hours, or the account is disabled
0xE - KDC has no support for the encryption type
0x12 - KDC Policy rejects request

Based on the 0xE and 0x12, you would want to first verify that the system time on that machine matches the time on your DCs, that the account has no logon hour restrictions, and is not disabled.

Also, what domain/ forest function level are you set to, and do you have any 2008/ 2008 R2 DCs?

share|improve this answer
    
I did check the PC and server local time and they do match. We have 2003 and 2008 DC R2 –  user630320 Oct 21 '11 at 10:56
    
I just dont understand why its not say where the account hsa been locked out. it should say PC1 has locked this user account but in our DC logs it just say account locked out. –  user630320 Oct 21 '11 at 10:58
    
Can someone please help with this. –  user630320 Nov 3 '11 at 13:22
    
Are you still having this problem? What have you done from the PC end other than the above? Virus, malware checks? Can you remove from domain temporarily and check the behavior? I'd consider that... (Make sure you have a local admin account first.) –  Ben Campbell Nov 10 '11 at 0:12

I came across this little gem recently. We had a user that was getting locked just about every day. It would usually occur at logon or sometime shortly thereafter (timing was never consistent).

We used the lockout tools to determine that the lockout was coming from a desktop that she had never used. It turned out that the user naming convention y0000000 was part of the issue. The user on the machine that was locking out the account had transposed two numbers to match the locked out user account. It had gotten cached so when the user on the lockout machine logged in the other account would get locked out. We opened the Credential Store and deleted the offending entry.

Fun!

share|improve this answer

I had the same issue one time with another user and I found that the pc contained malware. I removed it using Malwarebytes and didn't see the user account being locked out again.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.