Thanks for the links. There are two accounts that are locking out constantly. There is no machine name associated with the attempt. Both accounts are regular users so wouldn't have been used to run services.
On Mon, Jul 24, 2017 at 10:51 AM, Michael B. Smith <[email protected]> wrote: > Here are some resources: > > > > https://www.microsoft.com/en-us/download/details.aspx?id=18465 > > https://www.microsoft.com/en-us/download/details.aspx?id=15201 > > http://activedirectorypro.com/account-lockout-tool/ > > > > Regards, > > Michael B. > > @essentialexch > > > > *From:* [email protected] [mailto:listsadmin@lists. > myitforum.com] *On Behalf Of *CSSU NetAdmin > *Sent:* Monday, July 24, 2017 10:24 AM > *To:* [email protected] > *Subject:* [NTSysADM] Account Lockout issue > > > > We have a Windows 2012 R2 AD network. For reasons unknown, some Windows > logon accounts are randomly locking out. We can unlock them but they > immediately relock. The individuals are not trying to login, they don't > have accounts on phones, etc. The lockout is not appearing in the Security > event log. We did notice that there are many Windows Filtering Platform > blocked a packet (5152) events. We are not sure if this is related to the > issue. > > > > The lockout problem started on Friday last week. > > > > Thanks for any help! >
