Windows Domain accounts gets locked without any failed logon events

Question

I have a domain account which keeps getting locked without any prior wrong password login attempts:

I.e (completely stripped off the details, just to give you an idea)

10:15:49 - logon successful 10:16:55 - logon failed (account locked)

There's something very odd here: I would expect at least one event between a successful logon and failed logon due to locked password. Where's the event that causes the lock with a failed password?

Other information:

-It's a MS RemoteApp system: there's a remoteapp system where people login via a web portal. The authentication happens during people logging into the web portal.

-There's no genius who's randomly locking accounts, even that should be in the logs, amirite?

Are failed logins being logged across all domain controllers? — user2320464, Aug 30 '16 at 20:31

score 1 · Answer 1 · edited Apr 13 '17 at 12:13

1

Microsoft's account lockout tools might help you figure out what's going on.

There's no genius who's randomly locking accounts, even that should be in the logs, amirite?

Not necessarily.

Honestly, I kind of want to copy and paste Ryan Ries' answer here, so I'll link it instead.

My guess would be that someone has used their personal account for a service, but that's only a random guess.

edited Apr 13 '17 at 12:13

Community

1

answered Aug 30 '16 at 19:16

Katherine Villyard

18,550
4
37
59

I've used that tool too. It showed "0" failed attempts but the account was locked regardless. Go figure! – user2629636 Aug 30 '16 at 20:04

Windows Domain accounts gets locked without any failed logon events

1 Answers1