I am facing a problem, every day around 17:00 4-5 domain user accounts get locked out. I think that the problem is from a script that is running ... somewhere... the problem is that I cannot pinpoint which computer/server tries to log in with incorrect credentials. Is there a way to find the computer name/IP of this machine?
I usually have luck doing it this way:
- Run LockoutStatus.exe.
- Enter the username and find out which of your DCs was the source of the lock ("Orig Lock" column) and when it happened ("Lockout Time" column).
- Examine the Security log on the DC at that time and you will usually be able to pinpoint it to a specific machine.
- Once you have the machine it's usually:
- User has a scheduled task running in their name and their password has changed.
- User has a disconnected RDP session.
If it happens at the same time daily I'd say its almost certainly a scheduled task.
This was answered a while ago - My useraccount gets permanently locked by someone