Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ever since I changed the admin password on my work domain, the admin account keeps getting locked out in the morning when users start logging on to their computers. I am not sure why a user logging on to their PC would try to use the admin account, but I keep getting Event 675 with failure code 0x18. After a few of these failed logons, the account is locked out. The User ID in the error is the domain admin and the Client Address is the IP address of a user's computer.

After everyone is logged on in the morning, the admin account no longer gets locked out--it only happens during the time everyone logs in. I have not seen a pattern as to specific computers causing the lockout (so I do not suspect an attempted security breach).

Any idea on why this is happening and how I may fix it?

share|improve this question
Have you checked for a scheduled task that's set to run at user logon that might be using the account in question? – joeqwerty Apr 7 '14 at 15:46
Sometimes people set services to start as a network admin because the service needs access to network resources... then they promptly forget they did that. The password for the service could need updating? – Digital Chris Apr 7 '14 at 15:46
up vote 2 down vote accepted

It sounds like a service or a mapped drive is using the admin account with the old password. The error log should show the IP or name of the computer that has the issue.

share|improve this answer
The logon script uses the admin credentials in it (compiled script). I had changed the password in the script but the updated script did not replicate to all of the domain controllers for some reason. Once I manually copied the new script to the domain controllers, all is good again. – Chris Apr 9 '14 at 15:24

First, i would suggest that you take a look in the event log for event code 4740, it should have the computer name or IP that caused the lock.
If the lock caused by random computers, then check them for a stored credentials in the services, or scheduled tasks, or any other application that the password stored inside it.
Or somewhere in a login script and you forget about it.

share|improve this answer

You will be able to see the events in the Event Viewer why your account is being locked out. It is Event ID 644. Make sure that your Security Audit is set to Success/Failure though to see these errors inside the DC's event log.

Additional, Event ID 529 which is a failed logon attempt should list everywhere that has the wrong credentials saved.

share|improve this answer

As addition to the already good solutions:

It is possible to auto-login into windows using a predefined username and password, even on domains. If this fails it will present the normal login. But this could cause the user to get locked in the first place.

share|improve this answer

there is a utility netwrix account Examiner. you can download it from Download, configure it and it will tell where your account are getting locked out.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .