0

We have a service account in our AD environment (Windows 2003) got locked out frequently.

some background information:

  • Windows 2003 domain
  • the account is set to never expire
  • we never changed the password of this account
  • The interval between each time i unlock the account is totally random.

Sometimes, the account runs normally for a week or two without any problem; while some other time, it locks again one day after i unlock

At first, i thought the account might be used by a process or schedule job or something which has a misconfigured password. I checked security logs on all DCs but found nothing. I tried the Microsoft Account Lockout Tool as well, and no luck as well.

We checked internal network traffic (assuming if the lockout is triggered by a server/endpoint machine), but couldn't find any invalid login attempt using this account.

We have lots of other service accounts in the same AD environment, and none of them are having the same issue.

I'm really running out of clue .... any help is much appreciated!

Thanks a lot!

  • an additional info - i reckon it has something to do with the expiration date (even it's set to never expired), so i tried giving it a expiring date like Dec 31, 2050 but that changed nothing. The account got locked out again few days after i unlocked it last time. – Sun Cleverland Sep 5 '16 at 9:50
  • So when you say We have a service account in our AD environment (Windows 2003) got locked out frequently but you cannot find anything relevant for this login in ALL DCs security event viewer logs... What is the indicator that the account is being locked out? Does something fail to run with this service and if so what are you using it for like FTP automation, some server service doing something, etc. I assume someone is not just seeing in AD users and computer or NET USER commands so give a little explanation of at least what this server is touching domain resource and function wise. – Pimp Juice IT Sep 6 '16 at 2:39
  • this is a service account used for backup purpose. As soon as it got locked, the backup job will fail. This account has been used by the backup service for years and the problem only started occurring few months ago. Provided that nothing's been changed in the backup job as well and as i mentioned, the password has not been changed on this account too.... if it's locked by invalid login attempt, there should be something logged in event viewer. – Sun Cleverland Sep 6 '16 at 2:50
  • What does the error message in your backup software say when the failure occurs and what are you using software wise like ArcServe. etc. and is it backing up via network or some client agent? I assume the backup job fails on various servers and not just one so there's no commonalities there either? – Pimp Juice IT Sep 6 '16 at 2:52
  • It's is ArcServe. The message is "The request is denied by the agent. The username/or password is invalid (Node=machinename@IPaddress)". Since jobs haven't been modified for long long time (no new nodes added), it's using the same account/password combination for years. And as described, it happens randomly. If one of the backup job has a wrong username/password, i assume the locked up should happen in a regular basis (all jobs are running either weekly or daily at particular scheduled time). The strange part of this lock up thing is sometimes we can run without problem for a wk or two – Sun Cleverland Sep 6 '16 at 2:59
0

To find out the reason of account lock out, you must configure the advanced audit policy setting. It will help you to track and audit logon events in GPO. Once you have successfully configured the policy, You could query the security event log for event ID 4740. Please refer to below article which summarizes the information in detail - https://community.spiceworks.com/how_to/128213-identify-the-source-of-account-lockouts-in-active-directory

  • Welcome to Super User. Can you provide instructions on how to configure the policy setting and what to look for in event ID 4740? While linking to source material is helpful and encouraged, on this Q&A site we value definitive answers that remain useful even when external links become broken. Thanks for contributing. – Twisty Impersonator Sep 8 '16 at 13:01
  • i did check audit log but there's no failed security event using this particular account. I tried the microsoft account locked out tool as well which again found nothing. I want to know, is it possible, that the account actually isn't used by any program/script, but the AD itself expires the account somehow (though the account is set to never expired) – Sun Cleverland Sep 12 '16 at 9:16

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.