Active Directory Question

Troy210 · Nov 23, 2015

Hello all,

We have AD 2008 installed on our servers here at work, and we keep running into a weird issue. My Boss's AD account needs to be unlocked like 3-4 times a day. We've tried changing his password, just in case another machine like an iPad is yutzing with things. No dice.

Anyone got any clues to what might be causing this?

PainfulByte · Nov 23, 2015

You can use Microsoft Account Lockout and Management Tools, particularly EventCombMT to scan through the DC security logs to find out where the lock out originated from. EventID 4740 I beleive. This can give you insight as to where the lockout originated.

Link: http://www.microsoft.com/en-ca/download/details.aspx?id=18465

It could be anything from a mapped drive with an old password to a mobile device. At least this tool can narrow the source device.

brandonwh64 · Nov 23, 2015

We have this issue as well. Usually its their phone or something else that accesses a part of the domain such as exchange that is trying to connect multiple times using a old password

Kursah · Nov 23, 2015

brandonwh64 said:
We have this issue as well. Usually its their phone or something else that accesses a part of the domain such as exchange that is trying to connect multiple times using a old password

This I've ran into quite a few times. Make sure you update the credentials on all connected devices if they're using a local exchange server as well since that will rely on AD for account credentials for the domain.

Troy210 · Nov 23, 2015

Its annoying as hell to have the boss call up @6am on the weekend saying his shit is locked out again

qubit · Nov 23, 2015

You'd think that the smartphone would be clever enough to only try a couple of times and then give up with an error, wouldn't you?

Troy210 · Nov 23, 2015

I found a AD plugin called NetWrix that automatically scans the AD looking for account lock outs. It does attempt to examine the source of the issue, but doesn't give up any concrete explanations.

m&m's · Nov 23, 2015

Here's a guide on how to use Account Lockout Status
You should be able to pin point from what device it's coming from with this guide:

https://community.spiceworks.com/ho...e-of-a-bad-password-and-account-lockout-in-ad

System Name	Don't Tell My Wife
Processor	i7-13700K
Motherboard	ASUS ROG Strix Z690-F Gaming WiFi 6E
Cooling	ASUS ROG Strix LC II 240 + Four 120mm Noctua's
Memory	32GB Vengeance DDR5 5600
Video Card(s)	RTX 3080Ti
Storage	(3) M.2 SSD's
Display(s)	Phillips 144Hz 1Ms + Gigabyte 34" ultrawide
Case	Lian Li Lancool 2 Mesh
Audio Device(s)	Onboard Sound
Power Supply	Corsair 850w Modular
Mouse	G502 Hero
Keyboard	Steelseries MERC - best kbd EVER!
Software	Win 10 Pro

System Name	Orion
Processor	Intel I7 3770K Ivy Bridge @4.6GHz
Motherboard	Asus Sabertooth Z77
Cooling	Corsair H100i
Memory	16GB Corsair Vengeance Dual/Quad Channel DDR3 CMZ16GX3M4A1600C9
Video Card(s)	EVGA 780Ti Superclocked 3GB (OC +130MHz/248MHz)
Storage	1x 240GB Kingston Hyper-X 3K, 3x 3TB Seagate ST3000DM001
Display(s)	Sony Bravia 55" KDL-55HX800 / Oculus DK1 / Oculus DK2
Case	CoolerMaster HAX
Audio Device(s)	OnBoard
Power Supply	CoolerMaster Silent Pro M2 850W
Benchmark Scores	UniEngine Valley 1.0 : 5539 3dMark Firestrike: 11468

System Name	Kursah's Gaming Rig 2018 (2022 Upgrade) - Ryzen+ Edition \| Gaming Laptop (Lenovo Legion 5i Pro 2022)
Processor	R7 5800X @ Stock \| i7 12700H @ Stock
Motherboard	Asus ROG Strix X370-F Gaming BIOS 6203\| Legion 5i Pro NM-E231
Cooling	Noctua NH-U14S Push-Pull + NT-H1 \| Stock Cooling
Memory	TEAMGROUP T-Force Vulcan Z 32GB (2x16) DDR4 4000 @ 3600 18-20-20-42 1.35v \| 32GB DDR5 4800 (2x16)
Video Card(s)	Palit GeForce RTX 4070 JetStream 12GB \| CPU-based Intel Iris XE + RTX 3070 8GB 150W
Storage	4TB SP UD90 NVME, 960GB SATA SSD, 2TB HDD \| 1TB Samsung OEM NVME SSD + 4TB Crucial P3 Plus NVME SSD
Display(s)	Acer 28" 4K VG280K x2 \| 16" 2560x1600 built-in
Case	Corsair 600C - Stock Fans on Low \| Stock Metal/Plastic
Audio Device(s)	Aune T1 mk1 > AKG K553 Pro + JVC HA-RX 700 (Equalizer APO + PeaceUI) \| Bluetooth Earbuds (BX29)
Power Supply	EVGA 750G2 Modular + APC Back-UPS Pro 1500 \| 300W OEM (heavy use) or Lenovo Legion C135W GAN (light)
Mouse	Logitech G502 \| Logitech M330
Keyboard	HyperX Alloy Core RGB \| Built in Keyboard (Lenovo laptop KB FTW)
Software	Windows 11 Pro x64 \| Windows 11 Home x64

System Name	Don't Tell My Wife
Processor	i7-13700K
Motherboard	ASUS ROG Strix Z690-F Gaming WiFi 6E
Cooling	ASUS ROG Strix LC II 240 + Four 120mm Noctua's
Memory	32GB Vengeance DDR5 5600
Video Card(s)	RTX 3080Ti
Storage	(3) M.2 SSD's
Display(s)	Phillips 144Hz 1Ms + Gigabyte 34" ultrawide
Case	Lian Li Lancool 2 Mesh
Audio Device(s)	Onboard Sound
Power Supply	Corsair 850w Modular
Mouse	G502 Hero
Keyboard	Steelseries MERC - best kbd EVER!
Software	Win 10 Pro

System Name	Quantumville™
Processor	Intel Core i7-2700K @ 4GHz
Motherboard	Asus P8Z68-V PRO/GEN3
Cooling	Noctua NH-D14
Memory	16GB (2 x 8GB Corsair Vengeance Black DDR3 PC3-12800 C9 1600MHz)
Video Card(s)	MSI RTX 2080 SUPER Gaming X Trio
Storage	Samsung 850 Pro 256GB \| WD Black 4TB \| WD Blue 6TB
Display(s)	ASUS ROG Strix XG27UQR (4K, 144Hz, G-SYNC compatible) \| Asus MG28UQ (4K, 60Hz, FreeSync compatible)
Case	Cooler Master HAF 922
Audio Device(s)	Creative Sound Blaster X-Fi Fatal1ty PCIe
Power Supply	Corsair AX1600i
Mouse	Microsoft Intellimouse Pro - Black Shadow
Keyboard	Yes
Software	Windows 10 Pro 64-bit

Active Directory Question

Troy210

PainfulByte

brandonwh64

Addicted to Bacon and StarCrunches!!!

Kursah

Super Moderator

Troy210

qubit

Overclocked quantum bit

Troy210

m&m's

Processor	AMD Ryzen 5 3600X
Motherboard	ASUS TUF GAMING X570-PLUS
Cooling	Noctua NH-D15 SE-AM4
Memory	2x8GB G.SKILL Ripjaws V DDR4-3200MHz CL16 1.35V
Video Card(s)	MSI Radeon RX 6600 XT Gaming X 8G
Storage	Crucial MX100 512GB + Samsung 870 EVO 2TB
Display(s)	MSI Optix MAG24C
Power Supply	Seasonic FOCUS GX-550
Mouse	Razer Viper Ultimate
Keyboard	Corsair K60