Sign in

a remote salesperson gets locked out right after a password change. we unlock. it happens again

Solvedactive-directorylockoutwindows14 replies · 343 views · started
Reply
Accepted solution by Elif — microsofts Account Lockout Status tool (LockoutStatus.exe) shows bad password count and last bad paswsord time per DC, which quickly shows…
  1. Ivan S.
    @ivan.schmidt

    hmmmm ok a remote salesperson changed their password on Monday. Since then the account locks right after a password change:

    This app can't run on your PC

    This app can't run on your PC

To find a version for your PC, check with the
software publisher.

    we suspect something is still using the old password, but they have a laptop, a phone, a tablet and who knows what else. how do we narorw it down??

    weve already asked them to sign out everywhere, but thats easier said than done when nobody knows where everywhere is. is there a reliable way to find teh source of the bad password attempts?

    facepalm

    4
  2. Silas Costa
    @scosta_45

    what does event 4740 on teh PDC emulator show as teh Caller Computer Name?? ??

    4 1 helpful
  3. Ivan S.
    @ivan.schmidt
    in reply to @scosta_45

    ok so yes, an old phone in a drawer still syncs mail with the old password. a remote salesperson forgot it existed.

    2 7 helpful
  5. Lea
    @loose_pusher

    if the claler is an Exchange or ADFS/web server, the bad attempts come from outside (a phone or an attacker). check that servers logs (IIS logs, ADFS events) for the client IP and user agent.. lol smart lockout on teh cloud side and blocking legacy auth help alot against password spraying.

    5 5 helpful
  6. Dev Ekström
    @dev_cron
    in reply to @loose_pusher

    on the users PC check Credential Manager (control keymgr.dll) and remove stale Windows credentials. also check cmdkey /list. hope that helps :)

    6 1 helpful
  8. Rhea Ekström
    @thread_loop873

    hmmm find the source first, on the PDC emulator, look in teh Security log for event ID 4740 (account locked out). the Caller Computer Name field shows where the bad attempts came from, event 4625 (failed logon) and 4771 (Kerberos pre-auth failed) on DCs show the client address too.

    15 0 helpful
  9. Zoe Jansen
    @zoe.jansen60

    Quick PowerShell to read lockouts from the PDC emulator:

    Get-WinEvent -ComputerName <PDC> -LogName Security -FilterXPath "*[System[EventID=4740]]" | Select-Object TimeCreated, Message

    The message includes the caller computer.

    1 0 helpful
  10. Elif
    @polarsage
    Accepted solution

    microsofts Account Lockout Status tool (LockoutStatus.exe) shows bad password count and last bad paswsord time per DC, which quickly shows which site the attempts hit.

    2 15 helpful
  11. Hugo Schmidt
    @hschmidt

    oh ive been there lol for me it was teh cable 😂 swapped it and boom, fixed good luck man!

    3 1 helpful
  12. Erik Kowalski
    @erik.kowalski72

    hmm idk everyone keeps saying this but nobody posts proof... have u checked ur after settings? mine were reset after an update just my 2 cents

    2 4 helpful
  13. Dima A.
    @dadler

    Id also raise the lockout threshold slightly. Too-strict thresholds cause more helpdesk pain than they prevent attacks, especially with MFA in place.

    9 0 helpful
  15. Ivan S.
    @ivan.schmidt
    in reply to @polarsage

    @polarsage yesss the 4740 events pointed at the mail server, which led us to the old phone. removed teh profile and no lockouts in two days. u guys are the best!!!

    2 0 helpful

Reply to this topic

Sign in or create an account to reply.