In a nutshell: Is it possible to determine the specific process/exe that locks out an A/D account?
We periodically receive account lockouts for a service account in use on a Windows application server. The domain controller reports when the failed login attempts result in the lockout but does not provide any other information that would help us track back to the process that locked the account. The account cannot be used to log in locally and is only used for executing processes on that server. Having said that, this server is a hodgepodge of automated shell scripts, scheduled tasks, and services setup by in-house developers and external consultants.
I know the following:
- Account Name
- Originating Server
- Time of lockout
This whole thing has been terribly frustrating because it happens almost randomly (i.e. sometimes once a day, sometimes several times a day and rarely at the same hour). Even worse, it seems like this would be something that would be simple to trap if I just knew where to look.
I am an application developer and do not have extended privileges on our domain so any solution/suggestion that can be performed without domain admin privileges is a plus.