|
A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server. Is there a way to find out which app is causing it and why the app might be causing failed login attempts?
| |||
|
feedback
|
|
Have a look at the Account Lockout and Management Tools available on the Microsoft Download Center. Specifically LockoutStatus.exe and EventCombMT.exe. You might not be able to exactly pinpoint where the lockout is coming from but you should be able to narrow it down quite a bit to make it easier to see. Here are a couple more Technet articles that might help: | |||||
feedback
|
|
Basically you need following information
To find first, once account is locked out, go to Primary Domain controller of your domain and look for Event id 644 in security log, which will give the name of caller machine name. Note down the machine name and time at which event was generated. To find process or activity, go to machine identified in above event id and open security log and search for event ID 529 with details for account getting locked out. In that event you can find the logon type which should tell you how account is trying to authenticate. | |||
|
feedback
|
|
This topic is too old, but I just wanted to share a helpful tool if any one has the same problem reads this thread in future.. Lockout fixer is a free tool which lets you to quickly determine from where the invalid credentials are coming.. You can download lockout fixer Once you find out the source workstation using the above tool, finding which application is causing the issue should be little easy... Also, check the services,scheduled tasks,saved network passwords, browser passwords, mapped network drives etc... | ||||
|
feedback
|
