Active Directory Account lockout

[bigboy]

There is a problem with Account lokout in the infrastructure. Many active directory user accounts in the infrastructure are getting locked without any invalid attempt. The users are not logged into the PC but account is locked out. This happens for the users from particular OU and some users from different OU as well. We have tried to use aloclout.dll but got nothing from client machine. We also tried some more tolls like netwrix but nothing is helping? Can anyone please help.

[Gonzo]

Have you tried to enable auditng on the DCs? Are you able to enable auditing and look at each DC's security event log to check where and when the lockout happens?

[Beter 2 Burn Out]

You can use something like eventcombMT.exe from the Account Lockout tools to help try and track down where the account is getting locked out. You can use the built in search of AccountLockouts and search in the created text files for the user in question. Download it from the below link:

http://www.microsoft.com/downloads/d...displaylang=en

[BobbyS4]

Netwrix – we use this tool, and it’s been pretty helpful. Doesn’t work all the time though, but in several situations this worked really well. As for you symptomps it looks pretty much like Conficker worm attack and I suggest to read more about conficker/downadup and apply patches and tools suggested by others