Hi Jake....Not sure if these have been mentioned or not?
The one we see the most is when someone disconnects from an RDP session,
rather than logs out, then changes their password.
Next to that, persistent mapped drives, then scheduled tasks with the old
password.
John
"WILLIAMS, J.D."
<[EMAIL PROTECTED]
.state.tx.us> To
Sent by: [email protected]
[EMAIL PROTECTED] cc
ail.activedir.org
Subject
RE: [ActiveDir] Account lockout
08/02/2005 01:23
PM
Please respond to
[EMAIL PROTECTED]
tivedir.org
Check the event logs on your DCs for event 644 (I think) that should have
info on which computer is making the call that is locking your account out.
If you think you might have a service that is doing it, and you’re not sure
where to look, you can perform wmi queries against servers and look for the
startup account.
Here’s some simple code I pulled out of Scriptomatic to show the syntax you
would use:
On Error Resume Next
strComputer = "." ‘Dot would scan the local computer, put a server name in
to scan a remote one
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Service",,48)
For Each objItem in colItems
Wscript.Echo "DisplayName: " & objItem.DisplayName
Wscript.Echo "Name: " & objItem.Name
Wscript.Echo "StartName: " & objItem.StartName
Next
You could work with the code to make it more useful, but at least you can
use this to figure out how to get the info you need.
Thanks,
JD
From: Jake Stabl [mailto:[EMAIL PROTECTED]
Sent: Tuesday, August 02, 2005 10:53 AM
To: [email protected]
Subject: [ActiveDir] Account lockout
Good day everyone. Here is a crazy problem I am having today. I am logged
on to my laptop writing emails and administering my domain and then all of
a sudden my account will get locked out.. Just about every 5 minutes this
is happening and I don’t really know why? Where can I start looking to fix
this?? I am lost.
Jake
[EMAIL PROTECTED] ��V�r�y�&��-�����4���i�b��b��
