Sign in

who keeps locking out a remote salesperson? the hunt for a ghost device

Solvedactive-directorylockoutwindows8 replies · 202 views · started
Reply
Accepted solution by Maya Kaur — yeahhh quick PowerShell to read lockouts from the PDC emulator: [code] the message includes the caller computer. good luck man!
  1. Nina Dalton
    @nina_quartz

    so annoyed rn a remote salesperson changed their password on Monday. since then the account locks every time they open Outlook:

    This app can't run on your PC

    This app can't run on your PC

To find a version for your PC, check with the
software publisher.

    we suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else, how do we narrow it down?

    Weve already asked them to sign out everywhere, but thats easier said than done when nobody knows where everywhere is. Is there a reliable way to find teh source of the bad password attempts? thx in advance!!

    1
  2. Sami
    @samiz746

    does our CFO have a phone or tablet with company mail configured??

    13 0 helpful
  3. Ash
    @ash_socket

    same tbh

    0 1 helpful
  4. Nina Dalton
    @nina_quartz
    in reply to @ash_socket

    sorry forgot to say yes, an old phone in a drawer still syncs mail with teh old password. a remote saelsperson forgot it existed. hope thats enough info 😅

    3 0 helpful
  5. Daria Rossi
    @daria.rossi

    hmmm on the user's PC check Credential Manager (control keymgr.dll) and remove stale Windows credentials. also check cmdkey /list. worked for me anyway 🤷

    2 3 helpful
  6. Nell D.
    @nell_signal

    yeahhh exact same thing happened to my moms pc last month

    5 0 helpful
  7. Ivan D.
    @idubois-3hq

    after a password change, the usual suspects are: phones with a mail profile still using teh old password, mapped drives with saved credentials, Credential Manager entries, scheduled tasks or services running as that user, and disconnected RDP sessions on some server. worked for me anyway 🤷

    5 0 helpful
  8. Maya Kaur
    @mayak260
    in reply to @idubois-3hq Accepted solution

    yeahhh quick PowerShell to read lockouts from the PDC emulator:

    Get-WinEvent -ComputerName <PDC> -LogName Security -FilterXPath "*[System[EventID=4740]]" | Select-Object TimeCreated, Message

    the message includes the caller computer. good luck man!

    13 7 helpful
  9. Nina Dalton
    @nina_quartz
    in reply to @mayak260

    @mayak260 omg finally it was password spraying from outside... blocked legacy auth and teh lockouts stopped. thanks for teh pointers!

    3 2 helpful

Reply to this topic

Sign in or create an account to reply.