39

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server.

Is there a way to find out which app is causing it and why the app might be causing failed login attempts?

1

5 Answers 5

60

Have a look at the Account Lockout and Management Tools available on the Microsoft Download Center. Specifically LockoutStatus.exe and EventCombMT.exe. You might not be able to exactly pinpoint where the lockout is coming from but you should be able to narrow it down quite a bit to make it easier to see.

Here are a couple more Technet articles that might help:
Maintaining and Monitoring Account Lockout
Account Lockout Tools (description of the tools in the download linked to above)
Using the checked Netlogon.dll to track account lockouts
Enabling debug logging for the Net Logon service

5
  • That's a great post and conslidation of resource info. I wish I could upvote you more...
    – MikeJ
    Sep 14, 2009 at 18:54
  • Cheers, glad it helps :)
    – squillman
    Sep 14, 2009 at 21:15
  • It's worth noting, that these links do work for 2k3 servers only.
    – BetaRide
    May 16, 2013 at 5:53
  • 3
    Are there any similar tools for Server 2012 R2? Apr 30, 2015 at 18:40
  • This answer is obsolete and no longer works on Windows 2008 or newer. I ma also looking for a solution on 2012.
    – Ricardo C
    Jun 7, 2018 at 22:36
6

Basically you need following information

  1. From which machine account is getting locked out
  2. What process or activity on that machine is involved in lockout

To find first, once account is locked out, go to Primary Domain controller of your domain and look for Event id 644 in security log, which will give the name of caller machine name. Note down the machine name and time at which event was generated.

To find process or activity, go to machine identified in above event id and open security log and search for event ID 529 with details for account getting locked out. In that event you can find the logon type which should tell you how account is trying to authenticate.

Event 529 Details

Event 644 Details

3

I've been working on the service desk for about 4 years now, if none of the above solve your lockout issues try placing the affected user in a "group policy not applied" section of AD (to enable control panel access from their account) and then get them to log in and go to the control panel, search for Credentials and then click "Credentials". What will come up is all the computers stored credentials (usually there is one that is out of date i.e. incorrect), remove all the enterie's from the "vault" and that should resolve the issue with no further problems. The only side effect from this is that the user will have to reenter their credentials once the next time they use the application. Hope that helps some of the people out there

2
  • 1
    Should also allow you to view the stored credentials and see exactly which app is causing it ;) (its usually Adobe/Google/Apple Updater software or the rare LYNC addon in outlook) only other cause ive found is people putting incorrect details into their work phones (for emails) which can also cause the lockout
    – Jonathan
    Jun 18, 2015 at 5:00
  • Which "control panel" are you referring to? Mar 16, 2016 at 17:02
2

I had a student in a PowerShell class ask a similar question. He needed to know how to locate the client where accounts were being locked out on. We found the answer using a combination of auditing and PowerShell. Below is a link to the instructions and code.

http://mctexpert.blogspot.com/2012/08/where-did-users-account-get-locked-out.html

1
  • 3
    Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.
    – Scott Pack
    Oct 10, 2012 at 16:30
0

This topic is too old, but I just wanted to share a helpful tool if any one has the same problem reads this thread in future..

Lockout fixer is a free tool which lets you to quickly determine from where the invalid credentials are coming.. You can download lockout fixer

Once you find out the source workstation using the above tool, finding which application is causing the issue should be little easy...

Also, check the services,scheduled tasks,saved network passwords, browser passwords, mapped network drives etc...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .