Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know WHICH users are constantly getting locked out because of bad password attempts, and they're only coming from their machine (using the old out of date ms account lockout tool and others to find this out) I don't know what the source of these on the computers in question are. It happens even when their computer is just sitting there doing nothing. (they may have programs open, but there's no remote desktop to them or live person sitting at the workstation)

It seems to send one to the DC about every 15 to 30 minutes, but varies by user. I reset the lockout number to 20 so that they wouldn't be locked out all the time, but I'd like to find a solution for real.

No scheduled tasks are running at all, they unmapped all drives and remapped them. Even when those were in place, it seems odd that it would cause that many attempts in one hour anyway.

All machines are Windows 7 with latest updates and ran virus, malware, spyware scanners with nothing found.

We have a hosted exchange account with Rackspace, so not connected to the DC. (unless I'm missing something here)

share|improve this question
    
Definitely not an office prankster either? –  Mokubai Oct 11 '12 at 18:38
    
I would wipe each machine one by one. This is the ONLY way to make sure every machine on the network is clean. An event better solution would be to wipe every machine at once. If it happens again after a wipe then the server is compromised. –  Ramhound Oct 11 '12 at 18:42
    
> it seems odd that it would cause that many attempts in one hour. Could be a mobile phone with an old password checking email every 15 minutes. Do the bad password attempts happen when the user's computer is switched off? –  sgmoore Oct 11 '12 at 19:12
add comment

4 Answers

up vote 1 down vote accepted

I'm not sure whether it will work with Server 2008, but Microsoft have some tools for Server 2003 to track this sort of behaviour.

They are called Account Lockout Tools and you can download them from http://www.microsoft.com/en-us/download/details.aspx?id=18465 or read up on them at http://technet.microsoft.com/en-us/library/cc738772(v=ws.10).aspx

One of the tools will scan the eventlog on your domain controller looking for audit failures and will report the name of the device which initiates the request.

share|improve this answer
add comment
  1. Check the event log on an effected user's machine, you might get lucky and find failed attempts there.
  2. Get a user to volunteer, and run Process Monitor on their machine until the problem repro's. http://technet.microsoft.com/en-us/sysinternals/bb896645 (Turn on logging to disk, get the file from them, etc.)
  3. You might interview a few users and see if there's some program that they all run, maybe one that remembers their password or something. Did they all change their password recently?
  4. It may be necessary to resort to running Netmon (there might be newer versions out there, don't know) on one of their machines and examining the network traffic to determine which process is sending the logon attempt.
share|improve this answer
add comment

It is Outlook 2010. I had a user open and close just this program, and it took a couple seconds to connect to the server, and then when I ran Lockoutstatus (from Account Lockout Tools), every "bad password" coincided with the exact time that he opened Outlook. It was between 3 and 5 "bad attempts" per opening, though, not just one.

We use Rackspace Hosted Exchange 2010, though. We DO use the same firstname.lastname@notrealdomain.com as we do for logins on our domain controller. So, I'm matt.hughes@notrealdomain.com and I also logon to our DC as matt.hughes

share|improve this answer
    
We confirmed that when the user changes their password on the domain to the same as the one on hosted exchange, then the bad password attempts stop happening. –  Matt Oct 29 '12 at 19:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.