Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server.

Is there a way to find out which app is causing it and why the app might be causing failed login attempts?

share|improve this question
add comment

5 Answers 5

up vote 37 down vote accepted

Have a look at the Account Lockout and Management Tools available on the Microsoft Download Center. Specifically LockoutStatus.exe and EventCombMT.exe. You might not be able to exactly pinpoint where the lockout is coming from but you should be able to narrow it down quite a bit to make it easier to see.

Here are a couple more Technet articles that might help:
Maintaining and Monitoring Account Lockout
Account Lockout Tools (description of the tools in the download linked to above)
Using the checked Netlogon.dll to track account lockouts
Enabling debug logging for the Net Logon service

share|improve this answer
    
That's a great post and conslidation of resource info. I wish I could upvote you more... –  MikeJ Sep 14 '09 at 18:54
    
Cheers, glad it helps :) –  squillman Sep 14 '09 at 21:15
    
It's worth noting, that these links do work for 2k3 servers only. –  BetaRide May 16 '13 at 5:53
add comment

I had a student in a PowerShell class ask a similar question. He needed to know how to locate the client where accounts were being locked out on. We found the answer using a combination of auditing and PowerShell. Below is a link to the instructions and code.

http://mctexpert.blogspot.com/2012/08/where-did-users-account-get-locked-out.html

share|improve this answer
2  
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Oct 10 '12 at 16:30
add comment

Basically you need following information

  1. From which machine account is getting locked out
  2. What process or activity on that machine is involved in lockout

To find first, once account is locked out, go to Primary Domain controller of your domain and look for Event id 644 in security log, which will give the name of caller machine name. Note down the machine name and time at which event was generated.

To find process or activity, go to machine identified in above event id and open security log and search for event ID 529 with details for account getting locked out. In that event you can find the logon type which should tell you how account is trying to authenticate.

Event 529 Details

Event 644 Details

share|improve this answer
add comment

This topic is too old, but I just wanted to share a helpful tool if any one has the same problem reads this thread in future..

Lockout fixer is a free tool which lets you to quickly determine from where the invalid credentials are coming.. You can download lockout fixer

Once you find out the source workstation using the above tool, finding which application is causing the issue should be little easy...

Also, check the services,scheduled tasks,saved network passwords, browser passwords, mapped network drives etc...

share|improve this answer
add comment

Might help you out, process of investigating AD account lockouts

http://www.compuday.co.za/2012/11/13/active-directory-account-lockouts-investigated/

share|improve this answer
1  
Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info. –  slm Apr 5 '13 at 12:43
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.