[joey74055]

Hello, I have a user that is getting locked out 9 or 10 times a day for no reason. We have reset her password, changed it back to her old password, disabled and enabled her user account, reset her computer account, renamed her PC, rejoined the PC to the domain, restarted the PC and still no matter what she gets locked out even when she is not asked for her password. Windows 2000 domain, Win XP box. Any suggestions?

[AndyJG247]

Check the services on the machine.
Download the ALTools from Microsoft:
http://www.microsoft.com/downloads/d...displaylang=en
and see when specifically the account was locked out.
Check the security logs on the DCs to see which machine and you should be able to find a service or program (or even a user) that is causing it.

I think it logs 531 and 539 messages but you will be looking for something like:

User Account Locked Out:
Target Account Name: JBloggs
Target Account ID: DOMAIN\JBloggs
Caller Machine Name: A-SERVER

[Stonelaughter]

Go to the domain controller on which she has been locked out. Make sure you're auditing Account Management events, Logons and logoffs (success and failure).

You're looking for Account Management Events from the "Security" source, in the security log - event ID 644 - with the text that Andy posted above. The "Caller Machine Name" will be the machine which tried to log on with her ID and an incorrect password.

Favourite culprits:
1. your Active-Sync server or your ISA box does the login - check her mobile device password is correct.

2. Another workstation (one she VEHEMENTLY claims she never used before) is running a scheduled task with her credentials.

3. Her workstation is running a scheduled task with wrong credentials

4. Another workstation has been left logged in to her ID since before her last password change.

5. **BIG FAVOURITE** she has cached or saved passwords for websites/applications on her machine. Check the "User Accounts" control panel applet on her machine, go Advanced, Manage Passwords.

[joey74055]

Thanks Guys! The ALTool worked!
Again, thank you!

[AndyJG247]

No probs. Thanks for letting us know it was fixed.