User Account Lockout

I have never seen this before, so maybe someone can shed some light on this
for me. I have a user in a Windows Server 2003 / Citrix environment. I
unlocked the user's account and have been watching his account pretty
regularly. It appears that while he is logged in, his account will convert
to lock out status for no apparent reason.

Thanks,
Joseph

In news:20BDCF69-C3A9-4D23-9DDB-5D7CB871D003@microsoft.com,
josephr38@hotmail.com <josephr38hotmailcom@discussions.microsoft.com>,
posted the following:
> I have never seen this before, so maybe someone can shed some light
> on this for me. I have a user in a Windows Server 2003 / Citrix
> environment. I unlocked the user's account and have been watching
> his account pretty regularly. It appears that while he is logged in,
> his account will convert to lock out status for no apparent reason.
>
> Thanks,
> Joseph

Is he running something on his machine using his credentials that may be not
set properly? Also, it could be a 3rd party entity, even if something simple
as his blackberry http account into the system with the wrong credentials.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
aceman@mvps.RemoveThisPart.org

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Hi
As Ace said, check for resources that are being used with the wrong
credentials, additionally also look at the security log and check if that
user change his/her password recently. There're other scenarios where simple
mapped drives or services, apps, etc... with wrong credentials (it doesn't
have to be on one computer) may be causing the account lookout.

Additionally check at MS website and do a search by account lockout tools
and download the tools that will help you to identify the source of the
problem.

--

I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services

"josephr38@hotmail.com" <josephr38hotmailcom@discussions.microsoft.com>
wrote in message news:20BDCF69-C3A9-4D23-9DDB-5D7CB871D003@microsoft.com...
>I have never seen this before, so maybe someone can shed some light on this
> for me. I have a user in a Windows Server 2003 / Citrix environment. I
> unlocked the user's account and have been watching his account pretty
> regularly. It appears that while he is logged in, his account will
> convert
> to lock out status for no apparent reason.
>
> Thanks,
> Joseph

Hello Josephr38,

Download the accountlockout tools and management pack, as this will help you
pinpoint the issue.
http://www.microsoft.com/downloads/d...displaylang=en

Isaac

"josephr38@hotmail.com" <josephr38hotmailcom@discussions.microsoft.com>
wrote in message news:20BDCF69-C3A9-4D23-9DDB-5D7CB871D003@microsoft.com...
>I have never seen this before, so maybe someone can shed some light on this
> for me. I have a user in a Windows Server 2003 / Citrix environment. I
> unlocked the user's account and have been watching his account pretty
> regularly. It appears that while he is logged in, his account will
> convert
> to lock out status for no apparent reason.
>
> Thanks,
> Joseph

Hello josephr38hotmailcom@discussions.microsoft.com,

Using an account as service account can be one reason as said from the others.
Also the account lockout tools are a good starting point to find the source
of the problem.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I have never seen this before, so maybe someone can shed some light on
> this for me. I have a user in a Windows Server 2003 / Citrix
> environment. I unlocked the user's account and have been watching his
> account pretty regularly. It appears that while he is logged in, his
> account will convert to lock out status for no apparent reason.
>
> Thanks,
> Joseph

Is the account logged into more than one machine or is it running a service
on the same machine? A user could have mapped drives to a resource from one
machine, on a different machine he changes his password and then the first
machine attempts to stay mapped to a drive and the password is no longer
correct and eventually locks the user out. Or after a password is changed a
service is running that attempts to authenticate with an old password.

To help try and track down where the account is getting locked out use
eventcombMT.exe from the Account Lockout tools found out Microsoft's
website. Use the built in search AccountLockouts and search in the created
text files for the user in question.

http://www.microsoft.com/downloads/d...displaylang=en


You can also set the debug flag on NetLogon to track authentication. "This
creates a text file on the PDC that can be examined to determine which
clients are generating the bad password attempts."
http://support.microsoft.com/kb/189541
http://support.microsoft.com/kb/109626

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.


"josephr38@hotmail.com" <josephr38hotmailcom@discussions.microsoft.com>
wrote in message news:20BDCF69-C3A9-4D23-9DDB-5D7CB871D003@microsoft.com...
>I have never seen this before, so maybe someone can shed some light on this
> for me. I have a user in a Windows Server 2003 / Citrix environment. I
> unlocked the user's account and have been watching his account pretty
> regularly. It appears that while he is logged in, his account will
> convert
> to lock out status for no apparent reason.
>
> Thanks,
> Joseph

I had this same issue and went through all of the troubleshooting
steps listed above and it ended up being a users phone that was
syncing with exchange that had the wrong credentials entered.