Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Around the end of February, the password was about to expire on my Active Directory account.

So, I changed the password.

Since then, I can get locked out 3 to 10 times a day without me doing much of anything on my end. It can even happen when I lock the PC and step away to the restroom or while I am in the middle of writing code in Visual Studio.

Our network admin has been working with me to try and resolve this (he's tired of unlocking my account), and all of the bad password attempts originate from my PC.

So, I got to looking into certificates, and I noticed I have two (2), one of which has recently expired.


I started to delete the expired certificate, but Windows warned me that any data encrypted by me using that certificate would be non-accessible once the certificate was deleted.

How do I update an expired certificate?

How do I tell what data a certificate has deleted?

Could this expired certificate be causing my Active Directory account to get locked out?

share|improve this question

closed as off topic by HopelessN00b, mdpc, Jenny D, pauska, Wesley Apr 1 '13 at 1:08

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

No, it's probably nothing to do with the certificate. It's probably when you changed your password, you have some service or scheduled task on some machine somewhere that is still trying to function by using your old password. – Ryan Ries Mar 28 '13 at 18:28
You should go thank your network admin for being so understanding. I'd have given you to the end of the day to figure out where the account lockouts are coming from (and no, it's not the expired certificate), and re-imaged your machine if you couldn't. – HopelessN00b Mar 28 '13 at 18:51
I don't even see an expired certificate... – Dennis Kaarsemaker Mar 28 '13 at 19:07
@DennisKaarsemaker He's got the wrong one circled, but the bottom one has an expiration date of 2/6/2012. I think that one might be expired. – HopelessN00b Mar 28 '13 at 19:13
LOL - you're right. I thought it said 2013, not 2113. The Token Signing Public Key is still expired, though. – jp2code Mar 28 '13 at 19:13

No, expired certificates have no role in AD authentication (by default). Especially certificates in Chrome, which has no Windows-auth hooks at all.

What's much more likely is a service or scheduled task on your machine that's configured to impersonate you and never got the password change supplied. This service/task then runs every so often, attempts to authenticate, fails, and you get the lockouts.

You can fairly quickly look up if you have such a service configured by opening Computer Management, navigating to the Services section, and sorting the list by Log On As; if you're on any of 'em, right-click properties and enter your new password.

share|improve this answer
...or printer, or drive mapping, or... well, yeah, lots of possibilities, and they're a pain to track down. – HopelessN00b Mar 28 '13 at 18:49
Multiple Services under Computer Management, all are logged on as either Local Service, Local System, or Network Service. Which one am I? Local Service? The Local Service shows a Password and a Confirm password, but the current data is hidden (naturally). – jp2code Mar 28 '13 at 19:11
@jp2code No. The lockouts are coming from something that's using your username and old password. Probably fastest to blow away any mapped printers and drives and remap them with your new credentials. At least 9 out of 10 times, that's the problem. – HopelessN00b Mar 28 '13 at 19:15
All of our mappings are controlled by a script in the Group Policy. However, I see one that has a Red X on it, so I disconnected from that. It'll reconnect the next time I log in, though. Fingers crossed! – jp2code Mar 28 '13 at 19:20
Any other ideas? I still get locked out daily. I can add that Outlook keeps poping up a Security Alert saying our Exchange Server has an invalid security certificate. I wonder if that could be causing this. – jp2code Apr 4 '13 at 12:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.