Yep, those 3 reasons are our top ones. I would also add to the list any third party software (eg, Spotlight for Windows, ServersAlive) that has authentication buried in it.
Mike Thommes -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, August 02, 2005 2:44 PM To: [email protected] Subject: RE: [ActiveDir] Account lockout Hi Jake....Not sure if these have been mentioned or not? The one we see the most is when someone disconnects from an RDP session, rather than logs out, then changes their password. Next to that, persistent mapped drives, then scheduled tasks with the old password. John "WILLIAMS, J.D." <[EMAIL PROTECTED] .state.tx.us> To Sent by: [email protected] [EMAIL PROTECTED] cc ail.activedir.org Subject RE: [ActiveDir] Account lockout 08/02/2005 01:23 PM Please respond to [EMAIL PROTECTED] tivedir.org Check the event logs on your DCs for event 644 (I think) that should have info on which computer is making the call that is locking your account out. If you think you might have a service that is doing it, and you’re not sure where to look, you can perform wmi queries against servers and look for the startup account. Here’s some simple code I pulled out of Scriptomatic to show the syntax you would use: On Error Resume Next strComputer = "." ‘Dot would scan the local computer, put a server name in to scan a remote one Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2") Set colItems = objWMIService.ExecQuery("Select * from Win32_Service",,48) For Each objItem in colItems Wscript.Echo "DisplayName: " & objItem.DisplayName Wscript.Echo "Name: " & objItem.Name Wscript.Echo "StartName: " & objItem.StartName Next You could work with the code to make it more useful, but at least you can use this to figure out how to get the info you need. Thanks, JD From: Jake Stabl [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 02, 2005 10:53 AM To: [email protected] Subject: [ActiveDir] Account lockout Good day everyone. Here is a crazy problem I am having today. I am logged on to my laptop writing emails and administering my domain and then all of a sudden my account will get locked out.. Just about every 5 minutes this is happening and I don’t really know why? Where can I start looking to fix this?? I am lost. Jake [EMAIL PROTECTED] Vry&-4ibb [EMAIL PROTECTED] ��V�r�y�&��-�����4���i�b��b��
