Users locked after several password errors - Event ID 4625, CHAP and other issues

Question

The event log showing the user´s password error is shown here, partially:
An account failed to log on.
Account For Which Logon Failed:
                Security ID:                          
NULL SID
                Account Name:                    <USERNAME>
                Account Domain:                <USERDOMAIN>
Failure Information:
                Failure Reason:                    
Unknown user name or bad password.
                Status:                                  
0xc000006d
                Sub Status:                           
0xc000006a
Process Information:
                Caller Process ID:0x388
                Caller Process Name:           C:\Windows\System32\svchost.exe
Network Information:
                Workstation Name:            
                Source Network Address:   -
                Source Port:                         
Detailed Authentication Information:
                Logon Process:                   
CHAP
The "CHAP" puzzles me, but after converting the 0X388, we have the PID 904:
tasklist /FI "PID eq 904" /svc
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                    904 AeLookupSvc, Appinfo, BITS, CertPropSvc,
EapHost, gpsvc, IAS, IKEEXT, iphlpsvc,
LanmanServer, ProfSvc, Schedule, seclogon,
SENS, SessionEnv, ShellHWDetection,
  Winmgmt, wuauserv
Could RADIUS be be the responsible? Why RADIUS will send so many attempts to the AD/DCs? 
We´re using 802.1X with NPS n the DCs and user have two devices in the same physical port of HP the Switch: the user´s computer AND a Alcatel IP Phone, authenticated by a DOmain
User (service account) using MD5
We do not trace much information right now, but some of the users that are complaining about that, have changed their password recently, therefore, for some reason, the old
password are being re-used?

Answer 1

Hi Kay,
Since user passwords got changed recently, the account lockouts should be caused by stored expired credentials. Credentials can be stored within services, programs, scheduled tasks, scripts, RDP sessions or even mobile phones.
I suggest you try to locate the machine where bad password attempts are generated through event messages, or by using network monitor to capture real-time network traffic. After that, find the source which is sending the bad password, then clear stored credentials
on it.
If the source cannot be located, you may rename those problematic accounts to avoid subsequent lockouts.
More information for you:
Troubleshooting Account Lockout
https://technet.microsoft.com/en-us/library/cc773155%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396
Troubleshooting account lockout the PSS way
http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]