1

For several months I have been suffering Active Directory lockouts from my Windows 10 laptop, which I use in a networked, business environment. This happens around 4 times each day. Our IT administrator has checked the domain controller and assures me that the source of the lockout is my laptop.

In Event Viewer > Windows Logs > System I see this Warning at the time of the lockout:

enter image description here

'Computer' is indeed my laptop.

That is interesting but doesn't (I think) identify the actual program or service causing the bad logon attempt. How could I identify that program/service?

Improve this question
8
  • `The shown error message is too late at this point the account was already locked. When where you last forced to change your account password? May be there is an program running on your system that have saved your credentials for remote access that now uses the old password. Backup programs are a common candidate...
    – Robert
    Apr 27, 2020 at 12:18
  • Netwrix Account Lockout Examiner is a good resolution to spotting the cause of account lockouts
    – Virtuality
    Apr 27, 2020 at 12:19
  • Is the computer an AD member, or is it a standalone system with the SMB credentials manually saved?
    – u1686_grawity
    Apr 27, 2020 at 12:48
  • It's an AD member
    – DavidA
    Apr 27, 2020 at 13:24
  • @Robert Your suggestion about a program with incorrect credentials is possibly correct, but how do I identify that program?
    – DavidA
    Apr 27, 2020 at 13:29

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .