I just changed my domain password and now my account keeps getting locked out. There must be some process on my machine that attempting to authenticate with incorrect credentials. How can I find out which programs are attempting authentication?
-
Similar: serverfault.com/questions/65265/…– squillmanAug 26, 2013 at 19:28
-
@squillman Thanks, I did not find that via searching.– kzhAug 26, 2013 at 19:29
-
@squillman Nevermind, that post is for a SysAdmin, but I am wondering about what one could use from a client machine.– kzhAug 26, 2013 at 19:32
3 Answers
net use /d *
, and also go into Control Panel -> User Accounts -> "Manage your credentials" and remove anything.
Also, check "Scheduled tasks" for anything running as you, and check Services for anything running as you.
And do this on every machine you might be logged into, if you can't run the lockout tools against the DCs to confirm what machine it's coming from.
I know your question are towards programs on your windows box, but your problem might be solved outside this, as it could be a mobile device trying to connect to an exchange account or similar with the old password, thus locking up your user account
Likely culprits:
- Machines you are logged on to with RDP
- Your phone or other device connecting to your work email account
- automated processes on your machine (less likely in a normal work environment, but possible)
One way to check which remote machines you are logged on to is qwinsta /server:<servername>
. If you are still logged on, you use rwinsta /server:<servername> <session number>
to log off the session. Easier than manually logging on to each server, at least. I recently had to do this after changing my domain password.
mfinni's advice is good on checking for local processes. I would add checking any place you have your email account set up, and suggest logging off and then back on to the computer.