Need to find out which application is making an frequent account lockout in AD

Question

Hi ,
In my environment two of the user accounts are having an frequent account lockout.
We have found that the account lockout was happening in their own machines with the help of the event logs in the domain controllers.
Please tell us how do we find that which application on their machines are making an frequent account lock with the help of event logs else do we have some other options.
All of your suggestions are much appreciated.
Thanks & Regards S.Nithyanandham

Answer 1

Usage of Microsoft ALtools( https://www.microsoft.com/en-us/download/details.aspx?id=18465 ):
LockoutStatus application
 Run LockoutStatus.exe and choose File > Set target > Define “Target User Name”
and “Target Domain Name”
Tool will show you user with its “User State” (Locked/Not Locked), time when
account was locked (Lockout Time) and will allow you to Unlock Account if you
right click output string.
EventCombMT application
 This tool gathers specific events from Windows event logs of single or several
different servers to one central location.
 Run EventCombMT.exe > Right Click on “Select to search” field >Choose “Get DCs
in Domain” > Mark your Domain Controllers for search> Select “Security” log file >
Type “4740” in the “Event IDs” field > Choose “Success Audit” Event type > Click
“Search” > Wait for “Matching Events Found” counter to show some values and
click “Quit”
 In the opened window investigate file or files named by your domain controllers
names. You should be able to determine the originating system where lockout
happened by searching for “Caller Computer Name”
Aloinfo application
 This tool has 2 purposes:
 To display all user account names and the age of their passwords run cmd >
change directory to the one where ALtools were extracted > type @powershell >
Enter > type “./aloinfo.exe /expires /server:DC | out-file C:\temp\expires.txt” >
Enter
 To display credentials used for running services or for mapping network drives
run cmd > change directory to the one where ALtools were extracted > type
@powershell > Enter > type “./aloinfo.exe /stored | out-file C:\temp\stored.txt” >
Enter
You may also enable Netlogon logging on DC through command shell:
nltest /dbflag:2080ffff
Netlogon.txt file is created in %systemroot%/debug directory
Just don't forget to turn it off after investigation :) nltest /dbflag:0
Or you can use
Netwrix Account Lockout Examiner to troubleshoot account lockouts, it's free.
--- Jeff (Netwrix)