Account is locked out

[Rob]

I have an AD user account that is periodically being
locked out automatically. I reciently enabled and then
disabled the account lockout group policy.
Currently this policy is not defined, but I have a single
account that is being locked out on it's own. Where else
can I look to see how this account is being locked out. I
havent seen any event logs that are causing this.

Thanks,
Rob

 

[Richard Moreno]

Hi Rob-

Please investigate a Security Event Log on a DC and look for event id's 644
and 529.

--
Thanks,
Richard Moreno
MCSE NT4\2000, MCSA 2000

This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Guest]

Thanks for the quick reply, I dont have either events
logged on my DC's.

 

[Richard Moreno]

Hi-

Does this particular user account get locked out from anywhere or just their
one workstation? You mentioned GP in your original post, perhaps you may
need to run GPRESULT (if on W2K) if on W2K3 try using RSOP.

--
Thanks,
Richard Moreno
MCSE NT4\2000, MCSA 2000

This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Rob]

The user get's locked out of everything, when the user is
browsing outlook, she get's prompted for username and
password once the account is locked, access denied
appears while browsing the network.
Within the past hour it has been locked twice.
I will run GPResult since I am in W2k and see what I find.

 

[Guest]

The data Collected from GPresult seems ok. It's getting
settings from the correct GP's same as all the other
users. The GP is getting updated ok.

 

[Richard Moreno]

Ok, try the lockout tool from here:

http://www.microsoft.com/downloads/...9c-91f3-4e63-8629-b999adde0b9e&DisplayLang=en

See if all DC's show the account locked out.

--
Thanks,
Richard Moreno
MCSE NT4\2000, MCSA 2000

This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Rob]

Great tool..... thanks. I'll let you know what I find.

Rob

 

[Rob]

The tool showed be that the account was locked on all the
servers.... I unlocked the account, but a little after
that unlock I noticed that my Primary server counted a
couple bad password entry's on the user.
This user is currently out of the office and not
accessing the network.

Even though I dont have the policy set, it seems to be
locking out the user with bad passwords .

Rob