I just changed my domain password and now my account keeps getting locked out. There must be some process on my machine that attempting to authenticate with incorrect credentials. How can I find out which programs are attempting authentication?
net use /d *, and also go into Control Panel -> User Accounts -> "Manage your credentials" and remove anything.
Also, check "Scheduled tasks" for anything running as you, and check Services for anything running as you.
And do this on every machine you might be logged into, if you can't run the lockout tools against the DCs to confirm what machine it's coming from.
- Machines you are logged on to with RDP
- Your phone or other device connecting to your work email account
- automated processes on your machine (less likely in a normal work environment, but possible)
One way to check which remote machines you are logged on to is
qwinsta /server:<servername>. If you are still logged on, you use
rwinsta /server:<servername> <session number> to log off the session. Easier than manually logging on to each server, at least. I recently had to do this after changing my domain password.
mfinni's advice is good on checking for local processes. I would add checking any place you have your email account set up, and suggest logging off and then back on to the computer.