[kapilsharma11]

1. Use LockoutStatus.exe to determine that which DC is getting the wrong password and it will show you the excat time also.
2. Go to that DC....Open security log for the time exactly mentioned in LockoutStatus.exe and you will find the IP of souce computer sending the wrong password.
3. Once you get the IP of the source you can use the tools mentioned in below posts and if not critical you can re-build that machine.

* Check it on multiple DCs to ensure that the attempts are coming from same source else you might have to cleanup multiple machines.
**Ensure that audit for logon is enabled.

Thanks,

[Virtual]

As already mentioned, does it lock out when they are not logged in?

Further to this.

(1) Does it only lock out when logged onto the same computer?
(2) Have you got them to change their password using ctrl-alt-del option on laptop, get them to restart and then logon again.
(3) Have you deleted the cached logon account and other remembered passwords. Go to Run, type control userpasswords2, select the advanced tab and then Manage Passwords. Ensure in Windows 7 and Vista that you first type Run and then type the command into there.
(4) Failing this, in the past, I have demoted the computer to a workgroup and then re-joined it to the domain and it has resolved this type of issue.

[LASERPAPER]

have you used something like User Finder? I can't upload the link but have a search on Google for 'User Finder 3.0.0' and then download the trial version.

This will allow you to enter in the users details and then scan the network, they are problem logged into a machine that is locked in the corner that they have forgotten about.

[sco1984]

Originally Posted by LASERPAPER

have you used something like User Finder? I can't upload the link but have a search on Google for 'User Finder 3.0.0' and then download the trial version.

This will allow you to enter in the users details and then scan the network, they are problem logged into a machine that is locked in the corner that they have forgotten about.

@ Laser > It's a problem of a network virus called "win32.kido". I had exact same problem in my domain some months back.

Easiest way to get rid is perform Windows updates & keep antivirus updated. In my case I was using Kaspersky antivirus corporate edition and it was able to detect the virus but account lock out issue remained.

I had to make sure all PC's are up to date with windows updates.
My suggestion to you is rather than downloading loads of updates [ in case you dont have WSUS server ] just download latest months anti malware update from windows update site for all PC's and see the results.

I am pretty sure that the issue will be vanished in no time.

Regards,
Amey.

[ADworld]

Hi,

Please indentifiy PDC in your domain by using command "Netdom querry fsmo" . Please check event ID 644 in the security event logs after the account gets locked on PDC. It will show you name of the machine from where this account is getting locked. Remove all schedule task and other share folder save password form that machine.

Regards
Amit