0

For awhile now a user is having issues with his AD account locking up a few times a day.

I have enabled the audit logs in windows GPO to show login attempts and pushed it out to our 3 domain controllers.

They werent really showing anything (failure wise) so i went to the users workstation and looked at event viewer and its not showing that he failed to login 5 times. this leads me to believe its something more to do with email as his domain account cannot be accessed outside the building, and this problem started when he updated his password 2 weeks ago.

I've been searching for a way to look at exchange 2010s audit logs for failed login attempts but i have not been able to find anything beyond the GPO i have already setup.

Does anyone have any idea on this? The next thing i'm thinking is to change his login usersname and that would make so any email accounts he had setup at home/anywhere wouldnt lock the account anymore.

Any advice would be awesome!

Thanks guys

1

If the user account locked, then failed authentications to the domain controllers did occur - this includes if the failures were attempts to hit Exchange, which authenticates via the domain controllers.

Sounds like there's something wrong with the audit logging that you're doing on the DCs - you should be able to generate a failed login and verify that it's properly logged on one of the domain controllers. In addition, you should be able to find the event where the lockout was applied to the account and use that timestamp to find relevant login failure events.

  • it seems it just took a bit for the policies to push out. looking into the event logs more on the exchange server now shows correctly. – lbakerit Nov 19 '12 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.