Sign in

a developer gets locked out right after a password change. we unlock. it happens again

active-directorylockoutwindows7 replies · 170 views · started
Reply
  1. Sami Ziegler
    @frame_rider939

    im literally losing my mind here strange one, a developer gets locked out right after a password change, even on days theyre not working:

    The lockout policy is standard, nohting unusual. It feels like an automated attack, or a forgotten device. How can i tell which?

    Id like to rule out an attack before blaming a forgotten device. How do you tell teh difference between a stale password somewhere and someone actually guessing passwords from outside? seriously need help here 😭

    5
  2. Kai Kowalski
    @kai_nimbus

    yeahhh if teh caller is an Exchange or ADFS/web server, the bad attempts come from outside (a phone or an attacker). check that servers logs (IIS logs, ADFS events) for the client IP and user agent 🤦 smart lockout on teh cloud side and blocking legacy auth help alot against password spraying.

    2 0 helpful
  3. Ibrahim O.
    @ibrahimo538

    On the user's PC check Credential Manager (control keymgr.dll) and remove stale Windows credentials... also check cmdkey /list. fingers crossed 🤞

    6 0 helpful
  4. Mateo Jensen
    @mateoj261

    @cacheprobe nah thats not it, developer has nothing to do with it

    1 0 helpful
  5. Mateo Jensen
    @mateoj261

    @ibrahimo538 thank u this worked!! thank u thank u thank u

    1 0 helpful
  6. Pia Becker
    @pia.becker-33z

    yeahhh find the source first. On teh PDC emulator, look in teh Security log for event ID 4740 (account locked out). The Caller Computer Name field shows where teh bad attempts came from. Event 4625 (failed logon) and 4771 (Kerberos pre-auth faield) on DCs show teh client address too. worked for me anyway 🤷

    0 0 helpful
  7. Bea T.
    @cacheprobe

    hmmmm not sure about that before blaming devices, rule out password spraying. Check whether other accounts see failed logons from teh same source IP. just my 2 cents

    2 0 helpful
Read next · Defensive Security & Access Management
IS IT MY KEY, THE SERVER, OR WSL2? A PUBLICKEY MYSTERY
Solved · 14 replies
Read

Reply to this topic

Sign in or create an account to reply.