A user's account keeps getting locked out in Active Directory. It's probably caused by an app that's using Windows authentication to connect to SQL Server.
Is there a way to find out which app is causing it and why the app might be causing failed login attempts?
Have a look at the Account Lockout and Management Tools available on the Microsoft Download Center. Specifically LockoutStatus.exe and EventCombMT.exe. You might not be able to exactly pinpoint where the lockout is coming from but you should be able to narrow it down quite a bit to make it easier to see.
Here are a couple more Technet articles that might help:
Maintaining and Monitoring Account Lockout
Account Lockout Tools (description of the tools in the download linked to above)
Using the checked Netlogon.dll to track account lockouts
Enabling debug logging for the Net Logon service
Basically you need following information
To find first, once account is locked out, go to Primary Domain controller of your domain and look for Event id 644 in security log, which will give the name of caller machine name. Note down the machine name and time at which event was generated.
To find process or activity, go to machine identified in above event id and open security log and search for event ID 529 with details for account getting locked out. In that event you can find the logon type which should tell you how account is trying to authenticate.
I've been working on the service desk for about 4 years now, if none of the above solve your lockout issues try placing the affected user in a "group policy not applied" section of AD (to enable control panel access from their account) and then get them to log in and go to the control panel, search for Credentials and then click "Credentials". What will come up is all the computers stored credentials (usually there is one that is out of date i.e. incorrect), remove all the enterie's from the "vault" and that should resolve the issue with no further problems. The only side effect from this is that the user will have to reenter their credentials once the next time they use the application. Hope that helps some of the people out there
I had a student in a PowerShell class ask a similar question. He needed to know how to locate the client where accounts were being locked out on. We found the answer using a combination of auditing and PowerShell. Below is a link to the instructions and code.
http://mctexpert.blogspot.com/2012/08/where-did-users-account-get-locked-out.html
This topic is too old, but I just wanted to share a helpful tool if any one has the same problem reads this thread in future..
Lockout fixer is a free tool which lets you to quickly determine from where the invalid credentials are coming.. You can download lockout fixer
Once you find out the source workstation using the above tool, finding which application is causing the issue should be little easy...
Also, check the services,scheduled tasks,saved network passwords, browser passwords, mapped network drives etc...
