This usually happens within the same hour of re-enabling a user's account. The user will contact us because they have been disabled due to inactivity, we re-enable the account and then they will contact us within that hour and say they're still experiencing issues. When we go to check the account for a password lockout, we find that account has been disabled again.

We don't have any disabling feature that should re-disable the account within that time frame. It's been pretty frustrating since it's difficult to replicate. I was wondering if anyone has seen this and if they have, if anyone knows what could be causing it or how to address it?

  • So the account(s) become disabled, not locked, correct? Is it only happening with that single user account? How many Domain Controllers are on the network? If more than one, has their AD communications/syncing been checked? Jan 26 '17 at 16:59
  • Also, I'm pretty sure Windows logs to the Event Log when an account is disabled (Event ID 4725) any signs of those on the DC? Jan 26 '17 at 17:04
  • You're right, they become disabled, not locked. I think we do have multiple DCs. I'll check their syncing. I'll also check that event ID. Would that be under the Security page of Windows Logs, or...? Jan 26 '17 at 19:26
  • I'll be in the Security log. You may want to run DCDiag on each DC to ensure proper communications. Is it more than one user account that's experiencing this? Jan 26 '17 at 20:58
  • Is there a Group Policy setting affecting the user's account that is configured to disable it? I'm specifically thinking of the settings at Computer/Policies/Windows Settings/Security Settings/Account Policies/Account Lockout Policy. You can you Group Policy Results (or Modeling) in the Group Policy snap-in to check for this. Feb 21 '17 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.