- User is on Windows 7
- PDC, DC2 = Windows 2008 R2
- RSA = Windows 2003 R2
We have a user who's account keeps getting locked out everyday.
I have enabled the Netlogon logging on the PDC and the other Servers following instructions in this article: http://support.microsoft.com/kb/109626
I have used http://www.microsoft.com/en-us/download/details.aspx?id=18465 to troubleshoot where the account is being locked out.
When I run LockoutStatus.exe to see which DC locked the account it tells me the PDC has locked the user account.
When I check the PDC's netlogon log it tells me that DC2 asked to lock the account. When I check DC2's netlogon log it tells me the RSA Server ask to lock the account.
When I check the netlogon log on the RSA Server it is not telling me anything.
Is there any way I can find out why the account is being locked out?
I believe I know what is causing this account to get locked out but I can't determine which device. As far I know its an iPhone or iPad which is causing this account to lock out.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 30/08/2012 07:23:29
Event ID: 4740
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: PDC
Description:
A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: PDC$
Account Domain: DOMAIN
Logon ID: 0x3e7
Account That Was Locked Out:
Security ID: DOMAIN\USER
Account Name: DOMAIN
Additional Information:
Caller Computer Name:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328}" />
<EventID>4740</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2012-08-30T06:23:29.116920400Z" />
<EventRecordID>3364953631</EventRecordID>
<Correlation />
<Execution ProcessID="608" ThreadID="6100" />
<Channel>Security</Channel>
<Computer>PDC.DOMAIN.com</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">USER</Data>
<Data Name="TargetDomainName">
</Data>
<Data Name="TargetSid">S-1-5-21-284166382-85745802-1543857936-2058</Data>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">PDC$</Data>
<Data Name="SubjectDomainName">DOMAIN</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
</EventData>
</Event>
Does anyone know how I can find out which device is causing the lockout?
