Domain user is locking his user account- but I cannot figger out why!?

Question

I have a user, the CTO, who recently received a newly imaged workstation/notebook. He is using the same password for the last few password changes (this is between you and I!) but strangely, his user account has been locking on an irregular basis.I took
his machine out of the domain, renamed it and added it back to the domain and it seems to have been working fine for the last two weeks until the user came back from OS, connected to the local network (same domain) and his account started locking again.
I'm at my wits end here and cannot find the problem.
Here's what I've done so far:
* Removed all cached credentials from the workstation- from the browser and from the local computer cache.
* Checked for mapped drives- none found.
Here's what I've found so far:
* When his account locks, LockOutStatus shows his account has locked on the local AD server AD01.
Checking the Security log, I found the following:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          27/05/2014 12:07:40 PM
Event ID:      4776
Task Category: Credential Validation
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      AD01.mydomain.com
Description:
The computer attempted to validate the credentials for an account.
Authentication Package:    MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon Account:    hisusername
Source Workstation:    
Error Code:    0xc000006a
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4776</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>14336</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2014-05-27T02:07:40.997393300Z" />
    <EventRecordID>469726292</EventRecordID>
    <Correlation />
    <Execution ProcessID="532" ThreadID="5952" />
    <Channel>Security</Channel>
    <Computer>AD01.mydomain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data>
    <Data Name="TargetUserName">hisusername</Data>
    <Data Name="Workstation">
    </Data>
    <Data Name="Status">0xc000006a</Data>
  </EventData>
</Event>
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          27/05/2014 12:07:40 PM
Event ID:      4740
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      AD01.mydomain.com
Description:
A user account was locked out.
Subject:
    Security ID:        SYSTEM
    Account Name:        AD01$
    Account Domain:        mydomain
    Logon ID:        0x3e7
Account That Was Locked Out:
    Security ID:        mydomain\hisusername
    Account Name:        hisusername
Additional Information:
    Caller Computer Name:    
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4740</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2014-05-27T02:07:40.981770400Z" />
    <EventRecordID>469726291</EventRecordID>
    <Correlation />
    <Execution ProcessID="532" ThreadID="5952" />
    <Channel>Security</Channel>
    <Computer>AD01.mydomain.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">hisusername</Data>
    <Data Name="TargetDomainName">
    </Data>
    <Data Name="TargetSid">S-1-5-21-1469019637-268265805-317593308-17583</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">AD01$</Data>
    <Data Name="SubjectDomainName">mydomain</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
  </EventData>
</Event>
As you can see, there's no workstation name, which is strange to me.
I enabled debug logging with Netlogon (http://support.microsoft.com/kb/109626/en-us) but there is no entry for this specific time period.
The local Event Viewer | Security shows a number of failed audits, but nothing which seems to have anything to do with locking the account. Most of these are error 5152 (Filtering Platform Packet Drop), 5156 (Filtering Platform Connection) & 5157 (Filtering
Platform Connection) errors. I can detail these if you need me to, just let me know.
Can anyone suggest what else I can do?

Answer 1

Hi,
Please let me know the windows servers in your environment like Windows 2000, 2003, 2008 etc.
This is because , if you have set a GPO on your 2000 server, which is set to "Send NTLMv1" and the GPO on your Windows 2008 server is set to "Only accept NTLMv2." 
Checkout the below thread on similar discussion,
http://serverfault.com/questions/432280/password-authentication-fails-ntlmv2
Also checkout the below thread on audit failure with no workstation details,
http://social.technet.microsoft.com/Forums/windowsserver/en-US/3c1e1e0a-be1a-4529-b99e-99f8559114c5/evid-4776-can-see-user-name-but-no-workstation?forum=winserversecurity
Regards,
Gopi
JiJi
Technologies