Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server.

Is there a way to find out which app is causing it and why the app might be causing failed login attempts?

share|improve this question

6 Answers 6

up vote 43 down vote accepted

Have a look at the Account Lockout and Management Tools available on the Microsoft Download Center. Specifically LockoutStatus.exe and EventCombMT.exe. You might not be able to exactly pinpoint where the lockout is coming from but you should be able to narrow it down quite a bit to make it easier to see.

Here are a couple more Technet articles that might help:
Maintaining and Monitoring Account Lockout
Account Lockout Tools (description of the tools in the download linked to above)
Using the checked Netlogon.dll to track account lockouts
Enabling debug logging for the Net Logon service

share|improve this answer
That's a great post and conslidation of resource info. I wish I could upvote you more... – MikeJ Sep 14 '09 at 18:54
Cheers, glad it helps :) – squillman Sep 14 '09 at 21:15
It's worth noting, that these links do work for 2k3 servers only. – BetaRide May 16 '13 at 5:53
Are there any similar tools for Server 2012 R2? – Chris Powell Apr 30 at 18:40

Basically you need following information

  1. From which machine account is getting locked out
  2. What process or activity on that machine is involved in lockout

To find first, once account is locked out, go to Primary Domain controller of your domain and look for Event id 644 in security log, which will give the name of caller machine name. Note down the machine name and time at which event was generated.

To find process or activity, go to machine identified in above event id and open security log and search for event ID 529 with details for account getting locked out. In that event you can find the logon type which should tell you how account is trying to authenticate.

Event 529 Details

Event 644 Details

share|improve this answer

I had a student in a PowerShell class ask a similar question. He needed to know how to locate the client where accounts were being locked out on. We found the answer using a combination of auditing and PowerShell. Below is a link to the instructions and code.

share|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Oct 10 '12 at 16:30

I've been working on the service desk for about 4 years now, if none of the above solve your lockout issues try placing the affected user in a "group policy not applied" section of AD (to enable control panel access from their account) and then get them to log in and go to the control panel, search for Credentials and then click "Credentials". What will come up is all the computers stored credentials (usually there is one that is out of date i.e. incorrect), remove all the enterie's from the "vault" and that should resolve the issue with no further problems. The only side effect from this is that the user will have to reenter their credentials once the next time they use the application. Hope that helps some of the people out there

share|improve this answer
Should also allow you to view the stored credentials and see exactly which app is causing it ;) (its usually Adobe/Google/Apple Updater software or the rare LYNC addon in outlook) only other cause ive found is people putting incorrect details into their work phones (for emails) which can also cause the lockout – Jonathan Jun 18 at 5:00

This topic is too old, but I just wanted to share a helpful tool if any one has the same problem reads this thread in future..

Lockout fixer is a free tool which lets you to quickly determine from where the invalid credentials are coming.. You can download lockout fixer

Once you find out the source workstation using the above tool, finding which application is causing the issue should be little easy...

Also, check the services,scheduled tasks,saved network passwords, browser passwords, mapped network drives etc...

share|improve this answer

Might help you out, process of investigating AD account lockouts

share|improve this answer
Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info. – slm Apr 5 '13 at 12:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.