Sign in

ad lockouts every time they open outlook, and nobody is typing the wrong password???

Solvedactive-directorylockoutwindows11 replies · 399 views · started
Reply
Accepted solution by Una Weber — if the caller is an Exchange or ADFS/web server, the bad attempts come from outside (a phone or an attacker). check that servers logs (IIS…
  1. Sami Ekström
    @samie192

    long time lurker first post lol the marketing lead changed their password on Monday. Since then the account locks every time they open Outlook:

    This app can't run on your PC

    This app can't run on your PC

To find a version for your PC, check with the
software publisher.

    we suspect something is still using teh old password, but they have a laptop, a phone, a tablet and who knows what else. how do we narrow it down?

    Weve already asked them to sign out everywehre, but thats easier said than done when nobody knows where everywhere is. Is there a reliable way to find teh suorce of the bad password attempts?

    1
  2. Sara Rossi
    @nimbus_hound

    been there man find teh source first. On teh PDC emulator, look in the Security log for event ID 4740 (account locked out). The Caller Computer Name field shows where the bad attempts came from... event 4625 (failed logon) and 4771 (Kerberos pre-auth failed) on DCs show teh client address too.

    0 5 helpful
  3. Una Weber
    @uweber_30

    Quick PowerShell to read lockouts from the PDC emulator:

    Get-WinEvent -ComputerName <PDC> -LogName Security -FilterXPath "*[System[EventID=4740]]" | Select-Object TimeCreated, Message

    The message includes the caller computer.

    22 1 helpful
  5. Bea Celik
    @solidbuilder

    wait is active-directory even worth bothering with or should i just leave it

    2 0 helpful
  6. Milan Nakamura
    @mnakamura

    after a password change, teh usual suspects are: phones with a mail profile still using the old password, mapped drives with saved credentials, Credential Manager entries, scheduled tasks or services running as that user, and disconnected RDP sessions on some server.

    2 0 helpful
  7. Bram Silva
    @bram_cache

    @uweber_30 what did u end up doing in the end ??

    13 0 helpful
  8. Bea Celik
    @solidbuilder

    @nimbus_hound thank u this worked!!

    4 6 helpful
  11. Una Weber
    @uweber_30
    in reply to @nimbus_hound Accepted solution

    if the caller is an Exchange or ADFS/web server, the bad attempts come from outside (a phone or an attacker). check that servers logs (IIS logs, ADFS events) for the client IP and user agent. smart lockout on teh cloud side and blocking legacy auth help alot against password spraying.

    thumbsup

    0 3 helpful
  12. Sami Ekström
    @samie192
    in reply to @uweber_30

    @uweber_30 dude deleted stale Credential Manager entries and fixed the scheduled task. the marketing lead is happy and the helpdesk is relieved.

    2 0 helpful

Reply to this topic

Sign in or create an account to reply.