|
Posted by Andrew Hayes on August 21, 2006, 9:38 pm
Please log in for more thread options Hmm. Set "Audit Account Logon Events" and "Audit Logon Events" to
Success/Failure in the audit policy for both the Domain Security Policy and
Domain Controller Security Policy and I still can't see the event where the
account is getting locked.
We changed his password back to the old one but the account still gets
locked out. "Manage Passwords" is empty.
Has anyone ever seen the event message in the security log when an account
gets locked out? If so, what were your audit policy settings?
> Hi Andrew,
>
> Make sure that on the DCs you have auditing turned on for logon events so
> that you can see which machine is sending the bad passwords.
>
> Once you have determined the machine there are a number of places on a
> machine that store users passwords that could cause the password to
> lockout
> automatically. Some are:
>
> Services
> Mapped Network Drives
> Scheduled Tasks
> Credential Manager (Start -> Run -> control keymgr.dll)
> 3rd Party applications
> DHCP Server
> Malware
> etc.
>
> Since he just changed his password this morning I would suspect that it is
> somewhere he has saved it and just needs to update the password.
>
> Hope this helps,
>
> Brian Delaney
> Microsoft Canada
> --
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
> --------------------
>>Subject: Re: Account Being Locked Somewhere
>>Date: Fri, 18 Aug 2006 19:53:54 +0900
>>
>>Looked at his Services list. None of them are set to use his account.
>>
>>> One of my users, a developer, keeps getting his account locked out, but
> I
>>> don't see anything in the domain controller security event log that
> helps
>>> me figure out why it's being locked.
>>>
>>> He changed his password this morning, so maybe he has a service that
> uses
>>> his account.
>>>
>>> Is there any way to track down where (machine or otherwise) his account
> is
>>> being locked from?
>>>
>>
>>
>>
>
| 
XML Sitemap