Re: User account locked out without explanation

Brad wrote on 01/25/2010 10:23 ET :
We're running a W2K3 Active Directory environment. We have a problem with
user's AD accounts getting locked out unexpectedly. An examination of the
domain controller security event logs shows nothing like any bad password
attempts leading up to the lockout. We did find a series of LSASRV events in
the local PC System log, Event IDs 40961, and 40961, and in the Application
log there were two USERENV events, IDs 1006 and 1030, coinciding exactly with
the time the accounts get locked out. Google and Bing searches were not
fruitful. I would appreciate any suggestions on where to look for
information that would shed light on what relation, if any, these events have
on the account getting locked out.

This topic is too old, but I just wanted to share a helpful tool if any one
has
the same problem reads this thread in future..

Lockout fixer is a free tool which lets you to quickly determine from where
the
invalid credentials are coming.. You can download lockout fixer here:
http://lockoutfixer.cz.cc/
.

Relevant Pages

  • Re: acessing a share
    ... Event IDs are (in the order they are logged after entering ... If the servers are in a workgroup at ... respective specific servers at home and not domain accounts, ... and look and click on the cooresponding Source. ...
    (microsoft.public.windows.server.networking)
  • User account locked out without explanation
    ... user's AD accounts getting locked out unexpectedly. ... An examination of the ... domain controller security event logs shows nothing like any bad password ... the local PC System log, Event IDs 40961, and 40961, and in the Application ...
    (microsoft.public.windows.server.security)