All domain accounts get locked daily

[Matt]

Every 4 to 6 hours all of our domain accounts (67) get
locked out within 14 minutes. In the Security Event Log
the only thing that seems to be changing is the Caller
Machine Name which most of the time it is not a valid
machine name on our network, however once in a while it
is. I have enabled logging for successful and failure on
everything that I could think of. Here is a little info
about our network. Our corporate site has an exchange
server ( that also is the domain controller running active
directory) behind a Cisco PIX, there are 3 remote
locations that are connected through hardware (PIX) VPN's
over DSL or Cable services, and a handful of remote
clients that connect through software VPN's. Has anyone
else had a situation like this or can anyone help with
some ideas on how I can trouble shoot this?
Thank you,
Matt

 

[Shawn Rabourn \(MS\)]

There is an account lockout troubleshooter paper out there.

http://www.microsoft.com/downloads/...90-a13b-4977-a4fc-3e2b67e3748e&DisplayLang=en


I bet your account lockout threshold is too low. Check that setting out and
see what that is. We recommend 10. If your threshold is 3, I almost
guarantee a huge difference when you move to 10.

--Shawn
This posting is provided "AS IS" with no warranties and confers no rights.

 

[wutsitallabout]

Wouldn't this mean that someone who shouldn't be is trying
to login?