Account lock-outs on AD.

Bleek

Bleek

Bleek

Soldato
Joined
7 May 2004
Posts
5,503
Location
Naked and afraid
Our support desk has been experiencing a number of consistant account lock-outs for some time now, it appears to be the same users all the time of which there are around 10.

The other 400+ users don't experience the problem.

This is a Windows 2003 AD Domain with around 55 DC's, the above users with problems aren't using the same DC to authenticate.

Any ideas where to look or what to look at because event logs don't really reveal anything and our Windows engineers have run out of ideas? :confused:
 
Pea0n said:
Had a similar thing with accoutns being locked out in this situation as they were trying to authenticate with a proxy server on another domain. This kept failing transparently and locked the accounts out

- Pea0n
Click to expand...

How did you go about diagnosing and fixing that, it could possbily be happening to us as it does seem related to intranet access (i.e. that's the first thing they lose and hence realise they're locked out)?
 
I'd be surprised if Kaspersky Enterprise didn't pick that up?

We've had a suggestion that setting the 'Account Lockout Threshold' to 3 is too low as Microsoft recommend 10?
 
Deathwish said:
You have 400 users and 55 DCs?

Do you have ActiveSync / Exchange? We usually find that users change their domain password but forget their PDA.
Click to expand...

Remote sites are WAN linked over 1mbit, 10mbit or 100mbit 1-to-1 lines, each satellite office has it's own DC which doubles as file and print.

Exchange 2003 yes, ActiveSync no. We use BES.
 
hoppyintheuk said:
I've seen Conficker cause havok on peoples networks. Make sure you antivirus/windows is uptodate, thats for sure.
Click to expand...

I'll have a word with our security team but I do know they push out new AV the day it's released, which is practically every other day!

Same goes for patching which is handled by a third party app but managed by security team.
 
We may have found something, it seems that Acrobat updater is running on the user PCs with the problem. Perhaps it's an account caching issue with this updater? We've disabled it for now and will see if it makes any difference.
 
Felix said:
Is there any services using their credentials with old passwords?

IE they have updated their password but not amended this on any service that run on PCs or servers.
Click to expand...

We think we may have found the culprit, all the machines in question have Acrobat updater running in the background so we've had service desk disable it as they find it. Fingers crossed it's that simple!
 
You must log in or register to reply here.
Back
Top Bottom