Account Keepgetting Lockout from TMG Server

Question

Hi All,
one domain user account keep getting lockout every 30min from our TMG server. i have restarted the TMG server many times. earlier i was having only TMG SP1. after i encounter this lockout problem i have upgraded my TMG server to SP2.
my currently TMG Version : 7.0.9193.500
i have captured below event error from TMG server ( Event ID : 4648, Source : Microsoft Windows security )
A logon was attempted using explicit credentials.
Subject:
    Security ID:        NETWORK SERVICE
    Account Name:        TMGServerName$
    Account Domain:        WORKGROUP
    Logon ID:        0x3e4
    Logon GUID:        {00000000-0000-0000-0000-000000000000}
Account Whose Credentials Were Used:
    Account Name:        userid
    Account Domain:        domain
    Logon GUID:        {00000000-0000-0000-0000-000000000000}
Target Server:
    Target Server Name:    Domain.FQDN.org
    Additional Information:    Domain.FQDN.org
Process Information:
    Process ID:        0x2f98
    Process Name:        C:\Program Files\Microsoft Forefront Threat Management Gateway\wspsrv.exe
Network Information:
    Network Address:    -
    Port:            -
This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials.  This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
i am not sure, why the account keep getting lockout from TMG, any suggestion would really helpful.
srini

Answer 1

Hi There, 
Can you please confirm if you are publishing any Web applications through TMG? 
Like Active Sync or OWA ?
When you do some Pre-authentication at TMG Level, and you see source as TMG for account lockout, the root cause might not be TMG itself.
Reason is: When a client tries to connect to TMG and provides a old/wrong password, TMG is going to take the credentials on behalf of the user and take this to DC for auth. 
In case of a failure DC is always going to see the source for Failure Audit as TMG and NOT the real client which is connecting to.
If you are publishing services like active sync, may be you can check if the user's device has got a old password and causing lockout!.
Also you can do a Soft-lock out at TMG level, so that in case of too much failure attempts account will be locked at TMG protecting the original account in AD.
You can refer to the below link to learn more about soft-lockout.
http://blogs.technet.com/b/isablog/archive/2012/11/01/using-the-account-lockout-feature-in-tmg-2010.aspx