0

I know there are many threads who are similar like mine, but may I'm to stupid to get all these informations.

My problem is I changed my password and since them i get locked every ~5 minutes, I don't have any scripts who uses my creds, and also no known service who will use this.

Our PDC DC is DC02 and this is from his netlogon.log:

07/21 07:42:13 [LOGON] [5932] DOMAIN: SamLogon: Network logon of DOMAIN\MYUSERNAME from MYLAPTOP Entered
07/21 07:42:13 [LOGON] [5932] DOMAIN: SamLogon: Network logon of DOMAIN\MYUSERNAME from MYLAPTOP Returns 0x0

and if i'm locked I see this in the log:

07/21 07:46:59 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Entered
07/21 07:46:59 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Returns 0xC0000234
07/21 07:46:59 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Entered
07/21 07:46:59 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Returns 0xC0000234
07/21 07:47:00 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Entered
07/21 07:47:00 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Returns 0xC0000234
07/21 07:47:00 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Entered
07/21 07:47:00 [LOGON] [7244] DOMAIN: SamLogon: Transitive Network logon of DOMAIN\MYUSERNAME from MYLAPTOP (via DC05) Returns 0xC0000234

Event ID 4740 from Event Viewer: enter image description here It seems like something blocked to protocol this Event ID, 'cause I get no events.

Is there some way I can trace the programs on my latop who can cause this or any log who logs if a program uses wrong creds?

I also tried it with ALockout.dll but this won't create a file in C:\Windows\debug\

My Network Drives, this are the only one I have, and these mapped by our Domain: enter image description here

Also I did this yesterday:

enter image description here

I reinstalled Office and MS Teams, I clean the credentials manager where I saw my username and I run sfc /scannow also I rebooted sometimes yesterday.

Also I use Netwrix Account Lockout Examiner Console to unlock me, but it looks wired to me, 'cause my Bad Pwd Count is 0: enter image description here

7
  • Have a look at scheduled tasks and services that use your credentials. – Drifter104 Jul 21 at 14:44
  • I forgot my work laptop, but tomorrow, I'll update my post with all the things I already disabled @Drifter104 – lucki1000 Jul 21 at 15:35
  • Don’t forget mapped network drives where you explicitly entered your credentials. – Greg W Jul 21 at 23:02
  • post are updated – lucki1000 Jul 22 at 6:11
  • 1
    Just realised that poorly formatted list of events included events coming from your own computer. You need to check 4740 events on the DCs to ensure it's not being triggered from somewhere else. If you have multiple DCs, you can find the last one that had a bad logon attempt (before it locks) with this (requires AD powershell module): $u = (get-aduser "USERNAME").distinguishedName; (Get-ADReplicationAttributeMetadata $u -Server (Get-ADDomainController).hostname | where attributename -eq lockouttime) | ft server,LastOriginatingChangeTime -auto – LeeM Jul 23 at 10:05
0

maybe the user is locked in?

0xC0000234 User logon with account locked

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

3
  • but first it isnt locked, I unlock my user every ~5 minutes – lucki1000 Jul 21 at 14:33
  • 1
    yes, you look for the lockout event on the domain controller, and this should tell you what computer it's originating from. You may have a mapped drive using those credentials or a scheduled task or something cached in Credentials Manager on the computer where the lockouts are originating from. If it's from your own workstation, check scheduled tasks, unmount drives, delete credentials from Credential Manager, REBOOT the machine – LeeM Jul 22 at 1:13
  • An additional way is, that you may use WIFI with your User Credentials, this is what our customer locks in a daily manner. Did you verify this? Remind, also an Outlook or Remote Device with Email access can lead to blocked accounts – djdomi Jul 23 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.