Locked Out User

[hindustnidude]

There is one user who keeps getting locked out, at the time we unlock the account and he logs in his account locks again. We have tried to remove and add his computer to the domain and also deleted and recreated his user account but it will not go away. Is there anyone who can tell me how to solve this problem?

[dkumar]

Yes There are many things that causing this lockout issue..

Might be the account used for any mapped share drive and keeps getting try to connect Or

Any application that stores password and the password got changed..

DownloadLockoutStatus.exe tool and EventCombMT.exe to troubleshoot further

http://www.windowsitpro.com/article/...-accounts.aspx

http://technet.microsoft.com/en-us/l...8WS.10%29.aspx

[hindustnidude]

Normally, the account lockout status tool show 10 bad pwd count on just one DC. So does it means that it is happening because the user only authenticated with that DC or there might be an issue with that DC?

[Coolestman]

It looks to me that account is used for some services where a password might be not changing, can you check the machine of the user and if that doesnt work, then follow some links given below:

http://www.microsoft.com/downloads/d...displaylang=en

http://technet.microsoft.com/en-us/l...72(WS.10).aspx

http://support.microsoft.com/kb/109626

[Big Fish]

I would also like to add that, inventory all services and apps that might be using that user account and check if he is connected concurrently elsewhere. You can even limit that user to only one concurrent session with Cconnet. By limiting a users concurrent connections in Windows Server 2003, install the Windows 2000 Resource Kit tool called CConnect.exe on each client computer, together with an .adm file that is supplied by the tool, check below link for more information:

http://support.microsoft.com/kb/237282

[dkumar]

By default every password count should processed from PDC, however you see the logon server using command
open command prompt and type
set l

[techman]

You can check some article written om "Troubleshooting Account Lockout" to solve the issue that you are facing by reading from the below website:

http://technet.microsoft.com/en-us/l...=ws.10%29.aspx

[hindustnidude]

Thanks for the replies guys. I have used the account lockout tools, in particular eventcombMT.exe and the built-in search for Account Lockouts and it seems that the issue was with Cisco ACS account.

[jesse]

You can even download netwrix account lockout examiner. We had a similar issue last year and downloaded the free evaluation version of the tool, and it told us exactly what we needed—if I remember correctly, our problem was a mapped network drive.

[Gunilla]

This actions takes place if you map a network drive to the first obtainable drive letter later than the drive letters for the local volumes and CD-ROM drives. While you setup a new device or volume, Mount Manager, which assigns drive letters to volumes, does not distinguish the mapped network drive and assigns the next obtainable drive letter to the new device or volume. This causes a crash with the existing mapped network drive. I wish this will help to solve your problem.