Re: [ActiveDir] Accounts Locked

[Peter Jessop]

I had a similiar problem a few weeks ago. The only difference was that things did not return to normal on their own. I came in one day and found that about 80% of the domain accounts were locked out and more were being locked out by the minute.
After briefly panicking I solved the problem in the following way.
1. Unlocked the locked out accounts with Unlock (www.joeware.net)
2. By viewing Failed logon attempts on the DCs, I found that they all came from the same PC.
3. PC was infected with some sort of malware.

Regards

Peter Jessop