Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My account in the domain at work comes up locked every morning and it's turning out to be unbearable. The domain admins have no clue as to what could be causing it and therefore I must call evey morning to have my account unlocked. I normally don't log off when leaving for the day, next morning I can unlock my computer and access my workstation but when I try to do anything domain-related I realize my account is locked.

This is what I've tried so far:

  1. Deleted all network drives
  2. Made sure all the servers I remotely access neither have a session with my account or a service running under my account.
  3. No service is locally running with my account in my workstation.

What else can I try?

share|improve this question

4 Answers 4

up vote 3 down vote accepted

It sounds like there's a scheduled task, SQL Server job, or similar thing running every night which is set up to use an expired password of yours.

You (well, the admins) can audit logons on the domain controller and look for failed logon attempts; that should show you which computer it's coming from, but you may need to hunt around to find what task/program is causing it.

If they're not willing to do that for you, though, then you may need to hunt around. Maybe try turning off different workstations each night and see if your account is locked the next morning; if it's not, you can be reasonably certain one of the down computers is the one making the bogus logon attempts. Repeat until you find the single machine causing it, then spelunk around until you find the culprit.

share|improve this answer
    
I've done a lot of SQL server stuff the past year so I definitely will look into that right away and post back. Thanks for the suggestion! –  Joel May 5 '10 at 13:18
    
The culprit was scheduling Cognos jobs with my user. Refreshing credentials is required in Cognos when passwords expire in order for schedules to run. More than 3 schedules are set to run every day, thus locking the account. This was showing nowhere. –  Joel Jun 16 '10 at 17:00

You should scan for viruses and stuff as well. Malwarebytes is a useful tool, its free and easy to use.

share|improve this answer

There is a tool from microsoft called EventCombMT - a domain admin can run this against the domain controlers. There is a Built in Search for "Account Lockouts" and it will tell you exactly which machine the attempts are coming from. An example I just looked up is below:

644,AUDIT SUCCESS,Security,Tue Aug 17 11:51:13 2010,NT AUTHORITY\SYSTEM,User Account Locked Out: Target Account Name: 'USERID' Target Account ID: %{S-1-5-21-3078125930-3267205474-2863779865-3344} Caller Machine Name: 'CulpritMachine' Caller User Name: DC Caller Domain: 'DOMAIN' Caller Logon ID: (0x0,0x3E7)

share|improve this answer

Have your domain admin looked in the security logs on the DC's at all, they should be able to tell you where its getting locked from. There are a lot of variables here like how many dc's and what domain function level. But the DA's should be able to answer this relatively quickly.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.