Where am I being locked out?!

This is an unusual problem and I'm hoping someone will have come across
something similar before.

Before I start I should state that I've hardly used Windows Server or Active
Directory, so go easy on me if this is something obvious!

I am having my account locked out on a daily basis. I know that this isn't
to do with my machine as it happens even if I get my account unlocked and
wait a day without turning my machine on I still can't log on the day after.
I'm pretty sure it's a piece of software that I've installed somewhere that
keeps trying to connect to the internet to check for updates. I've completely
scrubbed my machine and the one other machine I suspected it would be and
this problem is still happening. We have over 200 machines and it's
completely impractical for me to go around and check flash, adobe reader,
java, the antivirus, and every other program that updates itself on every
machine and I was just wondering if there was any way of seeing what machine
had made the connection attempt, be it by IP or name.

We use a combination of XP and Vista machines, connected to Server 2008 R2
servers.

Any help here would be greatly appreciated, this is driving me nuts!

Hi,
> This is an unusual problem and I'm hoping someone will have come across
> something similar before.
>
> Before I start I should state that I've hardly used Windows Server or Active
> Directory, so go easy on me if this is something obvious!

> I am having my account locked out on a daily basis. I know that this isn't
> to do with my machine as it happens even if I get my account unlocked and
> wait a day without turning my machine on I still can't log on the day after.
[....]

It is not obvious but the place to check is the event log of the domain controller or controlers.
Overthere should be an event telling your user account failed to log in properly and on which
machine.

That is how I once found out a machine I had logged on to do some service was now being used, of
better she tried to use it, by someone who was simply typing is her password but never changed my
login name to hers. After 5 attempts my account was blocked.
Her explanation when I found out: I never change that so why would I need to to do so now? :-(

Bonno Bloksma

Hello Miles,

Start with this tools for account lockout troubleshooting:
http://www.microsoft.com/downloads/d...displaylang=en

http://www.microsoft.com/downloads/d...displaylang=en

http://support.microsoft.com/kb/109626

http://www.pbbergs.com/windows/artic...eshooting.html

Also when conficker is in the system account lockout is a symptom:
http://support.microsoft.com/kb/962007

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> This is an unusual problem and I'm hoping someone will have come
> across something similar before.
>
> Before I start I should state that I've hardly used Windows Server or
> Active Directory, so go easy on me if this is something obvious!
>
> I am having my account locked out on a daily basis. I know that this
> isn't to do with my machine as it happens even if I get my account
> unlocked and wait a day without turning my machine on I still can't
> log on the day after. I'm pretty sure it's a piece of software that
> I've installed somewhere that keeps trying to connect to the internet
> to check for updates. I've completely scrubbed my machine and the one
> other machine I suspected it would be and this problem is still
> happening. We have over 200 machines and it's completely impractical
> for me to go around and check flash, adobe reader, java, the
> antivirus, and every other program that updates itself on every
> machine and I was just wondering if there was any way of seeing what
> machine had made the connection attempt, be it by IP or name.
>
> We use a combination of XP and Vista machines, connected to Server
> 2008 R2 servers.
>
> Any help here would be greatly appreciated, this is driving me nuts!
>