Why account lockout

Once done, it shows the following message. Enter the new password and then confirm it. Download Lepide Active Directory Auditor. In This Article. Go to the security logs, and search for the Event ID Once done hit search at the bottom. Computer This shows the name of server workstation where event was logged. Description This contains the entire unparsed event message. Log Name The name of the event log e. Application, Security, System, etc. Task Category A name for a subclass of events within the same Event Source.

Level Warning, Information, Error, etc. Category This shows the name for an aggregative event class, corresponding to the similar ones present in Windows version. Subject: Account Name Name of the account that initiated the action. Subject: Account Domain Name of the domain that account initiating the action belongs to.

Subject: Logon ID A number that uniquely identifying the logon session of the user initiating action. This number can be used to correlate all user actions within one logon session.

Resolution No evidence so far seen that can contribute towards account lock out. Resolution User has typed wrong password on the console. Resolution User has typed wrong password from the network. LogonType Code 4 LogonType Value Batch LogonType Meaning Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention.

Resolution Batch file has an expired or wrong password. Resolution Service is configured with a wrong password. Resolution User has typed a wrong password on a password protected screen saver. The built-in authentication packages all hash credentials before sending them across the network. The credentials may also expire, which will lead to account lockouts.

Some users are required to work on multiple computers. As a result, a user can be logged on to more than one computer simultaneously. These other computers may have applications that are using old, cached credentials which may result in locked accounts. Windows services can be configured to use user-specified accounts. These are known as service accounts. The credentials for these user-specified accounts may expire and Windows services will continue using the old, expired credentials; leading to account lockouts.

The Windows task scheduler requires credentials to run a task whether the user is logged in or not. Different tasks can be created with user-specified credentials which can be domain credentials. These user-specified credentials may expire and Windows tasks will continue to use the old credentials.

The following Active Directory attributes determine how many passwords change attempts a user can make in a given period of time:. Windows security logs go a long way to resolving account lockouts, however extracting account lockout information from Windows Security Logs is not always a reliable process.