Incredibly weird issue, Win 7 account locked out

Hi folks,
Ill dive straight in with this one as Ive been working on it since 9am today, with little progress.
I have USER A who's account locks out without them even being logged into their machine. The user changed their password yesterday as per company policy and since then it keeps locking out after 3-5 minutes.
Platform - WIN 7
Pro 64 Bit
Server - Win Server 2008 R2 Standard
I have done the following -
Cleared credential manager - NO DIFFERENCE
Reset IE
and cleared personal details during reset - NO DIFFERENCE
Tested by logging
onto another machine - NO JOY
Recreated their login profile - NO
DIFFERENCE
Checked for logged on terminal services accounts - NONE LOGGED IN
Connected devices ie. iPad, iPhone, Android - NONE
I have checked
on our DC's and have found the following -
- System
- Provider
[ Name] Microsoft-Windows-Security-Auditing
[ Guid]
{54849625-5478-4994-A5BA-3E3B0328C30D}
EventID 4776
Version 0
Level 0
Task 14336
Opcode 0
Keywords
0x8010000000000000
- TimeCreated
[ SystemTime]
2014-01-14T12:43:53.301501000Z
EventRecordID 2042599718
Correlation
- Execution
[ ProcessID] 516
[ ThreadID]
29720
Channel Security
Computer XXXXXXDC02.XXXXXXXXXXXXXX.co.uk
Security
- EventData
PackageName
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
TargetUserName USER A
Workstation
XXXXXXXX
Status 0xc0000234
I do not think this is an issue with the users machine. The reason I say this is because for one the issue follows the user when they logon to another machine. The second thing is, I took the machine completely off the network, as in disconnected it. Reset
the users account on the DC and just waited on the DC for 5 minutes. I double clicked into the users account again and under the account tab it was locked out again. What on earth could be causing this?
Jeet S

Event ID 4776 Status 0xc0000234 tells us there was a failed attempt because the account was already locked.
- Have you searched the logs for what computer is doing the lockout?
- Is there a possibility that the user is still logged on a different workstation and has it locked?
Maybe this can help:
Get the user's distinguishedname:
$DN = (get-aduser <username> ).distinguishedname
The check the Object Metadata for that account to find out exactly what time and DC the account was locked out on:
repadmin /showobjmeta <yourDC> "$DN"
Look through the results and find the property for "LockoutTime" (That'll tell you where to look)
Chris Ream
If you find my post to be helpful ( or the answer ), Please mark this post appropriately. Thank you!

Similar Messages

Authentication issues and account lock out in OIM

Hi All,
We are facing an issue where, When incorrect password is submitted using Identity Console then Active Directory bad-pwd-count is being incremented.
Any pointers on this will be helpful.
Thanks

I think your OIM authentication is happening from AD? Just check your Weblogic->Realm-> Authentication Provider setting and verify where its pointed to?
Home >Summary of Security Realms >myrealm >Providers
~J

ODM User account locking out daily

Hello,
I have a user in my ODM that has his account locked out almost daily. I have the server set to disable after 5 invalid attempts. I can't seem to find in the logs where the attempts are coming from. He has even been away from his laptop for the entire day only to find his account locked. Is there anywhere in the logs I can find out more information about where they are originating?
Thanks,
JL

Thanks,
It does initially look like his iPhone might be the culprit. We have his settings set perfectly and I am getting DIGEST-MD5 authentication succeeded in the ApplePasswordServer.Server log. I noticed before it failed, it was listing DIGEST-MD5 authentication failed, SASL error -13 (password incorrect). It seems I was relying too much on SA's log viewer so I went to the server and used console which shed more light on the issue.
I will let this ride for a day or two before closing out and awarding points.
Thanks
JL

SQL 2012 DB Engine [Login failed: Account locked out] alerts not received from SCOM 2007 R2

Dear Experts,
In our SCOM 2007 R2 environment SQL 2012 DB Engine [Login failed: Account locked out] alerts not received but we are receiving the following alerts fr the DB instance.
1. Database Backup Failed To Complete
2. Login failed: Password expired
3. Log Backup Failed to Complete
4. Login failed: Password cannot be used at this time
5. Login failed: Password must be changed
6. IS Package Failed.
Why we are not receiving the "Login failed: Account locked out" ? Customers are asking the notification email alert for this Rule even I have checked the override settings everything is enabled by default same as above rules.
What can be the issue here ?
Thanks,
Saravana
Saravana Raja

Hi,
Could you please check the Windows security log for (MSSQLSERVER) event ID 18486? The rule should rely on this event.
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Mac user account locked out in Microsoft Active Directory

Hi,
I have some users who get their user account locked out several times a day.
It seems to be an issue with the keychain.
Our users need to change their password every 90 days domain GPO applied on every users.
Do you know how to fix this issue?
I have notice that most of the time this happens when the Mac wakes up from sleep mode while still connected to the network and when the users try to re login.
Thank you.

Hi Nicky
I had a very similar problem a while back. It turned out that I had another device trying to retrieve mail from the corporate account. in my case it was an iPod that was just sitting on charge for weeks at a time but was accessing the Exchange server with the wrong password, after having changed it due to the same password policy you use. Of course after a set number of tries, the AD locked the account.
I always remember to change my iPhone password now
Jerry

Account locked out from RD server when no session is open?

Windows 2008R2 DCs, two in one site, one in another
Windows 2008 functional level
I've had two instances in the past week where users, several hours after changing their passwords, had their accounts locked out. I used LockoutStatus to track down the DC where the event 4740/lockout happened, and then read the calling workstation
from there. In both cases, the user didn't have any active or idle session on the remote desktop server where the lock was being generated. I checked further with Process Explorer and I couldn't even find any processes running in their user context.
I would unlock the account, and in under a minute, there would be six bad password attempts (our GP setting) and the account would be locked out. I could repeat this process indefinitely.
In both instances, when I rebooted the RD VM, the issue went away and didn't return. In one case that was somewhat disruptive as it was an application server. In the second case it was a domain controller and had no user impact.
I've seen this before when a user has an orphaned RD session idle for months, or with badly behaved applications, but this seeming dissociation from any active user process is really odd.
LockoutStatus always shows the lastPasswordSet timestamp in sync, replication occurs within fifteen minutes, and repadmin shows me both the expected topology and no errors.
I'm at a total loss. What more can I check for?

Hi,
Do you have any updates?
Other than Remote Desktop sessions, please also check these things below:
Programs, services, schedule tasks, scripts, which could also store user credentials.
More information for you:
Troubleshooting Account Lockout
http://technet.microsoft.com/en-us/library/cc773155(v=WS.10).aspx
Best Regards,
Amy

MacBook Pro Causing Account Lock-Out in Active Directory

Dear fellow forumers,
I'm having a MacBook Pro, running on Leopard. I'm running WinXP Pro on VM Fusion.I'm connecting my MacBook to a Local LAN enviroment in my company, but it is not bind to any AD.
But concurrently when i run WindowsXP Pro on VM Fusion, i actually join domain in the XP Pro.
If anyone can advise, what may be causing the frequent account lock-out whenever i run WindowXP on VM Fusion?

I'm having the same issue under Parallels. I connect to my corporate network using Cisco VPN. I have Entourage configured and Outlook configured in my VM. Cisco VPN is configured for both the Mac OS and for Windows XP within Parallels. I never run both simultaneously. If I connect to VPN within MacOS X, I can have both Entourage and Outlook open and the same time. I seem to notice more frequent lockouts when I do this. I have also tried running Entourage via OWS. This removes the need to use VPN on the Mac. However, I still get lockouts...just not as frequently. Any help greatly appreciated.

Account lock out error message

when the user account is locked out the ldap gives the standard 49 error, for both invalid password and even if the account is locked out. Is there a way to specifically configure it to give account lock out message instead of just the error 49.

Hi,
what you're asking should not be possible in terms of 'plain' LDAP Protocol; RFC 4511 (LDAP Protocol Definition), in [Appendix A.2|http://tools.ietf.org/html/rfc4511#appendix-A.2] describes the result codes that the server can return. According to that document (that is the current reference) 'err=49' means that the provided credentials are not valid. The standard LDAP protocol doesn't allow you to provide the additional information of 'why' the credentials are not valid using a different error code.
HTH,
marco

In terms of account lock outs due to security reasons, when is time to delete the account and create a new one?

In terms of account lock outs due to security reasons, when is time to delete the account and create a new one?

iCloud accounts and Apple IDs can't be deleted.
(79882)

Account locked out events are not getting in active directory security event logs

Account locked out events are not getting in active directory security event logs for some users. I can see that the user is locked and when i tried to find out the event in sec log at DC but couldnt able to find. It is only happening for some users.
not for the all users.

In addition.
Check the ADDS Audit.
Active Directory Services Audit - Document references
Regards~Biswajit
Disclaimer: This posting is provided & with no warranties or guarantees and confers no rights.
MCP 2003,MCSA 2003, MCSA:M 2003, CCNA, MCTS, Enterprise Admin
MY BLOG
Domain Controllers inventory-Quest Powershell
Generate Report for Bulk Servers-LastBootUpTime,SerialNumber,InstallDate
Generate a Report for installed Hotfix for Bulk Servers

Service accounts locked out issue.

Hi,
While monitoring production servers, I noticed that all the Host Instances were stopped. In the Event log, I could see several Account Locked notifications (Service accounts for Hosts). Below are the relevant error messages that I could see in the event
log for this exception.
"The BTSSvc$My_Host service was unable to log on as mydomain\SvcAccount with the currently configured password due to the following error:
The referenced account is currently locked out and may not be logged on to."
"Windows saved user mydomain\SvcAccount registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account."
I am not able to figure out the root cause and the possible remedy. Please let me know your thoughts about the issue.
Thanks and Regards,
Ujjwal
-Ujjwal

If this is the first time this has occured then it is possible that someone did change the service account passwords. Can you logon onto the BizTalk Machine using the Account & Password? If someone has changed the passwords you will need to go to each
machine, services.mmc and manually enter the password for each of the affected services.
If this is a recurring problem, it may be because of a Downadup.B infection and you'd need to take it up with the AntiVirus control team to help identify/rectify this.
Regards.

Squirrelmail/php - accounts locked out

I'm needing some help with Squirrelmail.
Tiger Server 10.4.2
Squirrelmail 1.4.5
php 4.3.11
I am experiencing the same problem as here. I have changed the session.gc_maxlifetime variable in php. This worked for about a month, last week users who logged in to SM occassionally became locked out of their account, the imapd process for their session had changed to the status of U (uninterruptible). Rebooting the server is the only solution. This has to be a SM or php issue, there are no problems with using any other email client, Outlook, T-bird, Eudora, etc. Does anyone have any other solutions?

The problem appears to have been solved. Check this thread for the solution: http://discussions.apple.com/thread.jspa?threadID=320386&tstart=0
Quicksilver 733 Mac OS X (10.4.2)

ICloud/iTunes Account Locking out Active Directory Account [?]

The facts:
I have been having this problem for the past four+ months.
My work email address is my iTunes account name
My work AD account gets logged out most evenings, sometimes within an hour of leaving work, sometimes late at night
I know when my account is logged out because my iPhone will ask for my Exchange password, or I cannot get into Outlook Web Access
When my iTunes/iCloud account password is the same as my Active Directory password this does not happen. When this was the case earlier this year I went 90 days without a lockout. The day after my password expired and I changed my password - locked out again
Exchange recognizes two mobile devices, my iPad2 and my iPhone 4, as mobile ActiveSync clients
I have reset both of these devices, updated to the latest iOS and reinstalled and reconfigured my apps
This occurs even when neither of these devices has an active ActiveSync account set up to use my work Exchange server
The keyrings (Mac) and Credential Managers (PC) of all my home machines have been sanitized
Mail (Mac) and Outlook are not configured on my home machines, and they are not affiliated with the work domain in any way
From these facts it seems to me that the issue is:
There exists a machine attempting to reach my Exchange account using a password I have used in the past
If it is a computer that I have possession of, it must be an iDevice, because this behavior has still occurred when all others have been powered off
If it is an iDevice under my control then it is something in iCloud/iTunes, because it does not depend on having the Exchange account configured on either iDevice and those are the only applications with knowledge of my work email address
So,
If it is my iCloud/iTunes account then WHY in the name of all that is sacred is it hitting my work Exchange server and locking out my account?
I can think of no other -possible- devices or online services that have both that password, and knowledge of that email address. I remotely wiped an old phone that might have had the email account configured.
Help?

I would very much like to hear from someone at Apple regarding this as I'm having a very similar if not the exact same issue.

Email sub-account locked out due to too many log in attempts.

Hi All, If someone has had this issue can you share how to get around this? When I try to log into my sub-account it sends me an access code. But the code brings me to my primary email account, not the sub-account. Thanks in advance for any help on this! VAFrank

Been on hold for over two hours on three different calls -- I guess Verizon tech support is off the holiday? Must be nice! Meanwhile, can't get to email on sub account! This is a sad joke!! You mean that I will be locked out of this email until they decide to take calls again? There is NO reason why I should not be able to correct this from the web without having to speak to anybody! Totally unaccepable. I had better control over sub-accounts with Comcast. Oh, well. I thought Verizon had their act together better than Comcast with customer service and web tools but evidentally I was wrong. With Comcast it was simple -- I paid their bills but never lost service and could fix anything myself. With Verizon, I pay pretty much the same amount for same service but at least I could fix issues suich as this -- I rarely had to call Comcast for tech support -- I've had to call Verizon THREE TIMES to fix this same issue in six months from hiccups with password programs -- I shouldn't see "NULL" for the secret question -- nor should I see the main account when I get locked out of the sub-account and go through the process to get the text code on the phone and whatnot, then get sent to the password settings for the main account -- that is sloppy! Worse, while I see "NULL" for my secret question -- the voice agents can see the question because they ask me for the secret answer! Sloppy, sloppy, sloppy! Worse, Verizon has no explanation for this unacceptable nonsense and has to know about it because I've brought it up with agents. That tells me Verizon simply doesn't care or is satisfied with how things are. I can get just as lousy customer service from Comcast but, as I said, at least I could fix issues such as this with clear instructions on the Comcast customer page -- no "hidden" or "special" links like what was mentioned earlier in this thread, which don't work anyway now if they did at one time! I was with Comcast for 10 years, never, ever had a situation where I couldn't unlock an account. So, counting the days until my contract is over! A year and a half, sadly.

Domain accounts locked out regularly

Hi,
I have quite a number of invalid log-on daily and causing locked out.
Action taken,
1. Unselected IPv6 from Windows 7 workstation
2. Follow PSS troubleshooting method
http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx
3. Using NetWrix Account Lockout Examiner - All results good fine except having lot of invalid logon; ranging from 20 to 60.
4. Netstat output from Windows 7 workstation
Active Connections
Proto Local Address          Foreign Address        State           Offload State
TCP    10.82.0.11:49182       austin801ai:52230      ESTABLISHED     InHost
TCP    10.82.0.11:50231       sippoolbl20a02:https   ESTABLISHED     InHost
TCP    10.82.0.11:50253       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50254       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50278       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50279       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50280       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50281       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50298       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50301       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50306       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50307       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50315       autocache:8080         ESTABLISHED     InHost
TCP    10.82.0.11:50316       autocache:8080         ESTABLISHED     InHost
TCP    127.0.0.1:49155        2OPSLW7N048:49156      ESTABLISHED     InHost
TCP    127.0.0.1:49156        2OPSLW7N048:49155      ESTABLISHED     InHost
What is next? Running out of idea. Please advice. Thanks.
Kelvin Teang

Greetings!
Firstly you should find out where these requests come from, so please enable auditing in Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit account management in group Policy and after next lockout,
check for event ID 4740 in you Event Viewer and Security section.
After that you need to find out what are the reasons behind this. Common problems are:
Entering your password incorrectly. (Note: not only for interactive logons but also when you are accessing a share)
Some services are configured incorrectly with the wrong credential, to put it another way they (The Services) try to start themselves with incorrectly configured credentials.
Map Network Drives. It sounds a bit weird but YES! If you have a mapped network drive on your PC you may have to take a look at the credentials again to make sure they are correctly configured.
In windows 7 and above there is a feature called “Credential Manager” which holds all the credentials required for accessing a share, mapped network drive and so on. It is another location which you have to verify the credentials.
Conficker Worm.
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Incredibly weird issue, Win 7 account locked out

Similar Messages

Maybe you are looking for