Exchange User Account Managment Task locking AD account

Question

User's AD account is locking within minutes. Windows logs show calling computer as the Exchange 2010 CAS server ( which is part of the CAS array).  We have disabled all mailbox features ( Active Sync, Mapi, OWA, POP, IMAP)  The
account still locks up within minutes and with same Windows event. There are no 1035 events on the CAS showing any brute force attacks and no other Logs referencing this event at all . The ISS logs show an old Samsung Phone that the user
had months ago and it broke. It doesn't make sense that it will  be blocking the account even when Active Sync is disabled for testing. I have gone ahead and blocked it anyway and removed it from the mailbox using MAPI MFC. I did check server
for Conflicker but did not see any thing odd in the registry. What can be causing this lockout ? Also the user does not have any tasks configured or passwords saved on the computer.
Windows Log:
og Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/17/2014 9:09:03 AM
Event ID:      4740
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      DOmainController.DOmain.local
Description:
A user account was locked out.
Subject:
 Security ID:  SYSTEM
 Account Name:  DOMAINCONTROLLER$
 Account Domain:  Domain Name
 Logon ID:  0x3e7
Account That Was Locked Out:
 Security ID:  Domain Name\User
 Account Name:  windows user name
Additional Information:
 Caller Computer Name: Exchange 2010 CAS server
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54878625-5237-4999-A5DA-4t567j328C30G}" />
    <EventID>4740</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2014-09-17T13:09:03.021253500Z" />
    <EventRecordID>331284493</EventRecordID>
    <Correlation />
    <Execution ProcessID="492" ThreadID="1036" />
    <Channel>Security</Channel>
    <Computer>DomainController.domain.local</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">Username</Data>
    <Data Name="TargetDomainName">Exchange 2010 CAS Server</Data>
    <Data Name="TargetSid">S-1-5-21-4059915145-90934678-67520089-8930</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">DomainControler$</Data>
    <Data Name="SubjectDomainName">DOmain Name</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
  </EventData>
</Event>
IIS Log Entry for the Old Phone which was removed now using MAPI MFC and Blocked. Note 10.88.11.2 is Load Balancers IP (changed in this post)
ault.eas Cmd=Sync&User=DomainName%5CDomainUserName&DeviceId=SEC1772877030523&DeviceType=SAMSUNGSCHI535 80 Domain\Username 10.88.11.2 SAMSUNG-SCH-I535/101.403 401 1 1909 0

Answer 1

Hello,
Ad replication has been tested with no issues.
The Test account locks up only if we intentionally enter the bad password. This was done to see that if our disabling of the Mailbox feature on the actuall production account would prevent locks due to request coming to exchange for that feature,
with a bad password. Apparently account will lock even if the mailbox feature is disabled. For example: if OWA if disabled for a mailbox entering the incorrect password for the account will lock the account.
So, currently we have done a work around; since the user has no pc to log in to - only uses Ipad and Iphone - we have changed the user name in AD. The account is not locking in but I am still seeing these eneteries in the IIS logs coming from his old phone
for the old username ( which broke and was trashed- this also tells us that if we revert to the actual username for the account it will lock). Also, disabling active sync for the user when user name was not changed did not have
any impact and request coming to active sync would still lock the account.
What should we do to prevent exchange from trying to respond to this request to active sync, from an old device ?   - the device was blocked on the account and removed through MFC when the issue surfaced but it did not fix the situation:
Request on IIS logs:
2014-09-18 00:01:07 10.97.10.20 POST /Microsoft-Server-ActiveSync/default.eas Cmd=Sync&User=Domain Name%5CUsername&DeviceId=SEC1342789030523&DeviceType=SAMSUNGSCHI535 80 DOmain Name\Username 10.1.10.46 SAMSUNG-SCH-I535/101.403 401 1 1909 0
Block Command Used:
[PS] C:\Windows\system32>Set-CASMailbox -Identity: "[email protected]" -ActiveSyncBlockedDeviceIDs: "SEC1342789030523"
Confirmed its listed as blocked:Get-CASMailbox Username | Select ActiveSyncAllowedDeviceIDs, ActiveSyncBlockedDeviceIDs
Note: ( Allowed devices are non since at that time we had removed all current active sync devices attached to the account to see if any of them were responsible for the bad request )
ActiveSyncAllowedDeviceIDs                                  ActiveSyncBlockedDeviceIDs
 {SEC1342789030523}