3

Problem

I have a Windows domain user account that gets automatically locked-out semi-regularly.

Troubleshooting Thus Far

The only rule on the domain that should automatically lock an account is too many failed login attempts.

I do not think anyone nefarious is trying to access my account. The problem started occurring after changing my password so I think it's a stored credential problem. Further to that, in the Event Viewer's System log I found Warnings from Security-Kerberos that says:

The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential mydomain\myuser.

I checked the Credential Manager and all it has are a few TERMSRV/servername credentials stored by Remote Desktop. I know which stored credential was incorrect, but it was stored for Remote Desktop access to a specific machine and was not being used (at least not by me) at the time of the warnings. The Security-Kerberos warning appears when the system was starting up (after a Windows Update reboot) and also appeared earlier this morning when nobody was logged into the machine.

Clarification after SnOrfus answer:

There was 1 set of invalid credentials that was stored for a terminal server. The rest of the credentials are known to be valid (used often & recently without issues). I logged on to the domain this morning without issue. I then ran windows update which rebooted the computer. After the restart, I couldn't log in (due to account being locked out). After unlocking & logging on to the domain, I checked Event Viewer which showed a problem with credentials after restarting.

Since the only stored credentials (according to Credential Manager) are for terminal servers, why would there be a Credential problem on restart when remote desktop was not being used?

Question

Does anyone know if Windows 7 "randomly" checks the authentication of cached credentials?

1

No, this isn't the case. What I suspect might be wrong is that you still have previous credentials stored. Try removing the stored credentials from Credential Manager, and then connect and log on to the domain (this will re-cache your credentials).

Afterward there shouldn't be any problems.

Note: There are also methods that your sysadmin could be using to expire cached credentials, but that doesn't seem to be the case here. You might want to ask, just in case though.

  • Understood that there was an invalid credential stored. But it was stored for terminal server access... why would it be checked on startup? I've deleted it to alleviate the lock-out issue, but the root of the problem still confuses me. – Farray Apr 15 '11 at 17:36
0

Some credential issues can be tied to invalid time settings and kerberos. Check the machine hes running and make sure its got the right time. If not, run w32tm /resync It might help.

  • To expand on this: Running NET TIME will also tell you what source the client is using to update the time. It SHOULD point to your AD server – Canadian Luke Apr 3 '12 at 18:53
0

I recently ran in to this issue as well on a few computers, and though this is an old question, I thought I would post something as there is a fix to this.

I've found this to be an issue on Windows 7, 8.1, and 10 (up to at least 1607).

The issue is within the Credential Manager, just not within the users Credential Manager, it is within the System account.

Troubleshooting

I ran in to this with a GPO which does a file copy from a remote server. Everything was working up until the user changed their domain password, at which point we started locking accounts.

Digging in to it I found an event 4098 in the Application log stating the following. This was created on every GPO Update, whether it was via a logged in user with gpupdate, or a background update.

The computer 'deployment.config' preference item in the 'File-Copy-GPO' Group Policy object did not apply because it failed with error code '0x8007052e Logon failure: unknown user name or bad password.' This error was suppressed.

Digging further I found an EventID 14 event in the System log stating the following. The user account listed was the one which was being locked so I knew I was on the right track.

The password stored in Credential Manager is invalid. This might be caused by the user changing the password from this computer or a different computer. To resolve this error, open Credential Manager in Control Panel, and reenter the password for the credential .

At this point I new it was the Credential Manager, though when I kept checking it in the various users, including the one which was locking, I couldn't find it. It got me thinking I should check the Systems Credential Manager as I was seeing the eventid even when no one was interactively logged in.

Solution

Using psexec -i -s -d cmd from an elevated command prompt, and then in the System account command prompt which is opened running rundll32 keymgr.dll,KRShowKeyMgr showed me what I was looking for. There was a stored credential, using the user account in question, for the server which hosted the file the GPO was trying to copy.

Resources

In trying to find information on this issue I came across this question, as well as the following two pages. I hope this helps someone else in the future.

http://btburnett.com/2014/05/windows-domain-account-lockout-mystery.html

https://social.technet.microsoft.com/Forums/windows/en-US/e1ef04fa-6aea-47fe-9392-45929239bd68/securitykerberos-event-id-14-credential-manager-causes-system-to-login-to-network-with-invalid?forum=w7itprosecurity

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.