finding the root cause of an account lockout

finding the root cause of an account lockout

I had an interesting case today where a user repeatedly got locked out even after

1.       Unlocking the user

2.       Resetting the password

3.       Resetting the password to the older password a user used to use

4.       Shutting down all of the machines the user was using at the moment

This did not fix the issue. In order to track what service is sending the user’s malicious password, I did the following:

1.       Turn on debug logging for the Net Logon service on the domain controller. 
http://support.microsoft.com/kb/109626

Note: This method cannot work on other DC’s as any bad password request is automatically forwarded to the domain controller with “PDC Emulator Role”
Warning: this will take up alot of the resources on the DC, so you have to be careful

2.       Reset the user’s password and unlocked the user.

3.       Wait around 10 minutes

4.       Navigate to C:\Windows\Debug and locate the file called netlogon.log

5.       Look for the username by doing ctrl+F

In this particular case, the user was not even logged on the computer. it was a network drive the user mapped for another user's session.  hope i don't have to do this again!!

To see multiple different things that can cause automatic lock out, see the article below

http://technet.microsoft.com/en-us/library/cc773155.aspx

thanks,

Rocky