Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
  • User is on Windows 7
  • PDC, DC2 = Windows 2008 R2
  • RSA = Windows 2003 R2

We have a user who's account keeps getting locked out everyday.

I have enabled the Netlogon logging on the PDC and the other Servers following instructions in this article: http://support.microsoft.com/kb/109626

I have used http://www.microsoft.com/en-us/download/details.aspx?id=18465 to troubleshoot where the account is being locked out.

When I run LockoutStatus.exe to see which DC locked the account it tells me the PDC has locked the user account.

When I check the PDC's netlogon log it tells me that DC2 asked to lock the account. When I check DC2's netlogon log it tells me the RSA Server ask to lock the account.

When I check the netlogon log on the RSA Server it is not telling me anything.

Is there any way I can find out why the account is being locked out?

I believe I know what is causing this account to get locked out but I can't determine which device. As far I know its an iPhone or iPad which is causing this account to lock out.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          30/08/2012 07:23:29
Event ID:      4740
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      PDC
Description:
A user account was locked out.

Subject:
Security ID:  SYSTEM
Account Name:  PDC$
Account Domain: DOMAIN
Logon ID:  0x3e7

Account That Was Locked Out:
Security ID:  DOMAIN\USER
Account Name:  DOMAIN

Additional Information:
Caller Computer Name:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328}" />
    <EventID>4740</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2012-08-30T06:23:29.116920400Z" />
    <EventRecordID>3364953631</EventRecordID>
    <Correlation />
    <Execution ProcessID="608" ThreadID="6100" />
    <Channel>Security</Channel>
    <Computer>PDC.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">USER</Data>
    <Data Name="TargetDomainName">
    </Data>
    <Data Name="TargetSid">S-1-5-21-284166382-85745802-1543857936-2058</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">PDC$</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
  </EventData>
</Event>

Does anyone know how I can find out which device is causing the lockout?

share|improve this question
1  
What's the login failure event right before the lockout event look like? If it's not there, you'll need to enable logging of those failures in your audit policy. –  Shane Madden Aug 30 '12 at 7:28
    
The entry you have shown displays the results, not the cause. The trigger events (there will always be more than one) may not be immediately below the one you've posted but you will need to locate at least one of them to see why this happened. More than likely, when you find the right entry you'll also have the answer to your question. –  John Gardeniers Aug 30 '12 at 10:19
    
It's usually a printer or drive mapping with old credentials anyway... usually more expedient to check that before even opening the event logs, in my experience. –  HopelessN00b Aug 30 '12 at 16:40
1  
By chance is the user using Exchange and an iPhone, these are notorious for causing accounts to become locked. –  Brent Pabst Sep 13 '12 at 20:15
    
It used to happen in a site i used to work at, we found out that the user shared his credentials with another employee and the other employee kept resetting the password every day, might be worth a check. –  Itai Ganot Oct 15 '12 at 8:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.