Account lock-outs on AD.

Bleek

Bleek

Bleek

Soldato
Joined
7 May 2004
Posts
5,503
Location
Naked and afraid
Our support desk has been experiencing a number of consistant account lock-outs for some time now, it appears to be the same users all the time of which there are around 10.

The other 400+ users don't experience the problem.

This is a Windows 2003 AD Domain with around 55 DC's, the above users with problems aren't using the same DC to authenticate.

Any ideas where to look or what to look at because event logs don't really reveal anything and our Windows engineers have run out of ideas? :confused:
 
I assume you're logging login attempts on the DCs, in which case is there any information to go on there?
 
Had a similar thing with accoutns being locked out in this situation as they were trying to authenticate with a proxy server on another domain. This kept failing transparently and locked the accounts out

- Pea0n
 
Pea0n said:
Had a similar thing with accoutns being locked out in this situation as they were trying to authenticate with a proxy server on another domain. This kept failing transparently and locked the accounts out

- Pea0n
Click to expand...

How did you go about diagnosing and fixing that, it could possbily be happening to us as it does seem related to intranet access (i.e. that's the first thing they lose and hence realise they're locked out)?
 
Could be a virus as well, Conficker locks out accounts :(
 
Last edited:
I'd be surprised if Kaspersky Enterprise didn't pick that up?

We've had a suggestion that setting the 'Account Lockout Threshold' to 3 is too low as Microsoft recommend 10?
 
The same ten users keep locking out their accounts... sounds like user error and account sharing?

I use a little code at the end of my login scripts that writes the username, PC, IP, date and time to a .txt file on a fileshare, you can then look through the log to see if the same account has been logged into on more than one PC at a time.
On top of that, we have a Splunk server that will report failed login attempts on every box on the domain, so between the two, I can find out if the account is being missused..

Also, checkout the Account Lockout tools provided by Microsoft, you can quickly see which DC the account is locked out on...

http://technet.microsoft.com/en-us/library/cc738772(WS.10).aspx
 
Bleek said:
How did you go about diagnosing and fixing that, it could possbily be happening to us as it does seem related to intranet access (i.e. that's the first thing they lose and hence realise they're locked out)?
Click to expand...

IIRC it was showing up as authentication failures in the event log of either one of our DCs or the ISAserver itself, I can't remember which.

The problem we had was that the ISA server was reaching the limit we set for the amount of concurrent connections. We upped the limit to reflect the actual number of connections being recieved.

- Pea0n
 
You have 400 users and 55 DCs?

Do you have ActiveSync / Exchange? We usually find that users change their domain password but forget their PDA.
 
I've seen this on an AD domain when one Windows XP PC had a set of cached credentials hidden away under Users in Control Panel. The cached credentials were out of date, but for some reason the machine would try to use them for something and then lock out the account.
 
Deathwish said:
You have 400 users and 55 DCs?

Do you have ActiveSync / Exchange? We usually find that users change their domain password but forget their PDA.
Click to expand...

Remote sites are WAN linked over 1mbit, 10mbit or 100mbit 1-to-1 lines, each satellite office has it's own DC which doubles as file and print.

Exchange 2003 yes, ActiveSync no. We use BES.
 
hoppyintheuk said:
I've seen Conficker cause havok on peoples networks. Make sure you antivirus/windows is uptodate, thats for sure.
Click to expand...

I'll have a word with our security team but I do know they push out new AV the day it's released, which is practically every other day!

Same goes for patching which is handled by a third party app but managed by security team.
 
We may have found something, it seems that Acrobat updater is running on the user PCs with the problem. Perhaps it's an account caching issue with this updater? We've disabled it for now and will see if it makes any difference.
 
You must log in or register to reply here.
Back
Top Bottom