Sign in

how do you find the device locking out an ad account?

active-directorylockoutwindows7 replies · 322 views · started
Reply
  1. Elena Arslan
    @ping_sprite

    the marketing lead changed their password on Monday. Since then teh account locks every morning at login:

    This app can't run on your PC

    This app can't run on your PC

To find a version for your PC, check with the
software publisher.

    We suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else. How do we narrow it down??

    We've already asked them to sign out everywhere, but that's easier said than done when nobody knows where 'everywhere' is. Is there a reliable way to find the source of the bad password attempts?

    2
  2. Kira Q.
    @kiraq106

    hmmm does a service desk tech have a phone or tablet with company mail configured? ??

    0 0 helpful
  4. Kira Q.
    @kiraq106
    in reply to @ping_sprite

    If the caller is an Exchange or ADFS/web server, teh bad attempts come from outside (a phone or an attacker). Check that server's logs (IIS logs, ADFS events) for the client IP and user agent. Smart lockout on the cloud side and blocking legacy auth help alot against password spraying.

    8 4 helpful
  5. Kira Q.
    @kiraq106
    in reply to @kiraq106

    After a password change, the usual suspects are: phones with a mail profile still using teh old password, mapped drives with saved credentials, Credential Manager entries, scheduled tasks or services running as that user, and disconnected RDP sessions on some server.

    2 0 helpful
  6. Rowan Larsen
    @rowan.larsen48

    ok so find teh source first. On the PDC emulator, look in the Security log for event ID 4740 (account locked out). The Caller Computer Name field shows where teh bad attempts came from. event 4625 (failed logon) and 4771 (Kerberos pre-auth failed) on DCs show teh client address too. good luck man!

    1 0 helpful
  7. Hugo
    @mutex_owl654
    in reply to @rowan.larsen48

    Before blaming devices, rule out password spraying. Check whether other accounts see failed logons from teh same source IP.

    6 0 helpful
  8. Elena Arslan
    @ping_sprite
    in reply to @rowan.larsen48

    @rowan.larsen48 yesss the 4740 events pointed at the mail srever, which led us to the old phone. Removed the profile and no lockouts in two days.

    3 4 helpful

Reply to this topic

Sign in or create an account to reply.