Account getting locked out
-
I have an account that is getting locked out every 10-15 minutes. Is there a way to see where the login request is coming from? I powered down the machine I thought the request was coming from but the account still gets locked out.
-
This will be in the Event Logs on the authenticating DC.
-
https://www.netwrix.com/account_lockout_examiner.html I have used this in the past. It is a great help. Sometimes, it is mapped network drives with old credentials.
-
Do you use RADIUS, if so did this user change their password recently?
-
@DustinB3403 said in Account getting locked out:
Do you use RADIUS, if so did this user change their password recently?
No RADIUS
-
Any services or scheduled tasks that might be setup under this account?
-
@DustinB3403 said in Account getting locked out:
Any services or scheduled tasks that might be setup under this account?
Possibly, however the password hasn't changed in the last 30 days that it would cause this.
-
@WLS-ITGuy said in Account getting locked out:
@DustinB3403 said in Account getting locked out:
Any services or scheduled tasks that might be setup under this account?
Possibly, however the password hasn't changed in the last 30 days that it would cause this.
Then something was turned on recently that is using a password older than 30 days.
-
@DustinB3403 said in Account getting locked out:
@WLS-ITGuy said in Account getting locked out:
@DustinB3403 said in Account getting locked out:
Any services or scheduled tasks that might be setup under this account?
Possibly, however the password hasn't changed in the last 30 days that it would cause this.
Then something was turned on recently that is using a password older than 30 days.
Nope. Turns out I had a couple servers that I was giving RDP remote access to another vendor for them to migrate to a new server and I forgot to turn off RDP.
