Member Avatar for gn0m3

Morning Folks,

my work pc is networked up and all access is controlled by a main active directory users account. This morning so far my account has been locked out 5 times with no reason as far as i can see. Is there a way i can check to see if someone else on the network is trying to use my password, or if there might be another reason??

Thanks a lot,

gn0m3

  • 6 Contributors
  • 6 Replies
  • 359 Views
  • 5 Years Discussion Span
  • Latest Post Latest Post by leknowlton

Dani AI

Generated

— repeated lockouts almost always come from an automated credential somewhere, not someone “trying” your password interactively. ’s log-checking idea and ’s EventCombMT tip point you in the right direction; add the VM, Mac and updater angles from and and work through this short, practical hunt-and-fix.

Likely hidden culprits: scheduled tasks, services or Windows services running as your account; mapped drives or logon scripts on other machines; Outlook/Exchange profiles or mobile devices using old credentials; printers/copiers or backup jobs that authenticate with your account; browser or system credential stores (Windows Credential Manager, Mac Keychain); and virtual machines or snapshots. Macs can store server logins in Keychain or auto-mount SMB shares; check “Login Items” and saved servers.

How to find the source quickly: determine the lockout times on the account, then correlate those times with DC logs and Netlogon traces. Example AD query to show bad password count/time (run from a machine with the AD module):

Import-Module ActiveDirectory
Get-ADUser -Identity "gn0m3" -Properties badPwdCount,badPasswordTime,LockedOut |
Select SamAccountName,badPwdCount,@{Name='BadPwdTime';Expression={[DateTime]::FromFileTime($_.badPasswordTime)}},LockedOut

Search domain controllers’ security logs for account lockout events (newer DCs log event 4740) or scan the DCs’ netlogon.log after enabling Netlogon debug to see the caller computer name/IP.

Immediate remediation plan: change the password once, do NOT change it repeatedly while hunting (that can hide the source). After the reset, update credentials on phones, VMs, mapped drives and services, then disable suspected services/devices one at a time until the lockouts stop. If it persists, collect the DC security + Netlogon logs and escalate to the domain admins or run Microsoft’s account-lockout tools for a definitive host source.

Recommended Answers

All 6 Replies

Member Avatar for Member #46692

Check the integrity of the security logs.

I.e log on as administrator, control panel, administrative tools, event viewer, security

Member Avatar for gn0m3

it points to a user who uses a Mac, i have been through all her proxy settings and network config but cannot find any reference to me? any more ideas?

Member Avatar for Paddy_Joe

Morning Folks,

my work pc is networked up and all access is controlled by a main active directory users account. This morning so far my account has been locked out 5 times with no reason as far as i can see. Is there a way i can check to see if someone else on the network is trying to use my password, or if there might be another reason??

Thanks a lot,

gn0m3

Get EventcombMT free from microsoft & run it on your domain controller searching for locked out accounts. it will tell you what machine is locking out the accont

Member Avatar for kildonan

If they have a virtual machine and are using the same user name on the virtual machine as the one in active directory, that is a problem.

Member Avatar for Kwajaji

Zindagi Na milegi Dubara

Member Avatar for leknowlton

Check to ensure that Adobe and Java updaters aren't to blame; they tend to cache credentials.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.