Once you have identified that machine locking your account you can check out the machine and see what's up In many cases it is a machine you logged onto and lever logged off from ote this is a successful action as the domain controller was able to successfully lock the account.
Finding cause of locked-out Active Directory Accounts. Posted on January 11, 2012 by Chris. Had this problem again today, and in the search for relevant event IDs found a set of Microsoft Tools from 2003 that I can’t believe I’ve not come across earlier. Download here: Microsoft Account Lockout and Management Tools. The important tools to me, 1  well not-so-fast, three-digit EventIDs are Sooooo WindowsXP/2003. Tracking down that user/computer that locks AD accounts. Troy Tate Profile: Troy Tate. With an environment spanning 18+ sites and more than 3000 computers around the globe, you could understand how challenging it would be to track down what device/user might be locking user accounts. You need to specify several things in this tool to get it to find the event log records of interest. The domain needs to be filled in. Then right-click in the Select To Search/Right Click to Add field and select what servers’ event logs you wish to scan for the event of interest. In this case, I’m choosing the domain controller that is shown in the Orig.Lock column in the LockoutStatus tool Either way you often find that no matter where you look you cant figure out from where and why your account is getting locked. The way to find the locking machine is to go to the locking authority. Active Directory. If you investigate the Security Logs on the active directory servers you will find the lockout events. On a Windows 2003 domain controller the event ID is 644. Note this is a successful action as the domain controller was able to successfully lock the account. The field information you want to know is: Target account name-the AD account name. Caller Machine Name-the machine name from where the account was locked out. 27. I recently received a request to determine why a specific user account was constantly being locked out after changing their Active Directory password and while I’ve previously written scripts to accomplish this same type of task, I decided to write an updated script.  If the device or user is locking out a security principal account, then severe action may need to be taken to ensure your environment is not placed at further risk letting the device and/or user remain on the network. You need to specify several things in this tool to get it to find the event log records of interest. The domain needs to be filled in. Then right-click in the Select To Search/Right Click to Add field and select what servers’ event logs you wish to scan for the event of interest. In this case, I’m choosing the domain controller that is shown in the Orig.Lock column in the LockoutStatus tool It notified the SCOM admin that the domain Administrator account was locked. The operations team was then tasked with tracking down what or who was locking this account. This is where the Microsoft Account Lockout and Management Tools came in use and helped isolate the cause. You need to specify several things in this tool to get it to find the event log records of interest. The domain needs to be filled in. Then right-click in the Select To Search/Right Click to Add field and select what servers’ event logs you wish to scan for the event of interest. In this case, I’m choosing the domain controller that is shown in the Orig.Lock column in the LockoutStatus tool To complete the following procedure, you must be logged on as a member of the Domain Admins security group. On a computer running Windows Small Business Server 2003, click Start, and then click Server Management. In the console tree, click Users. In the details pane, right-click the user account that is locked out, and then click Properties. On the User Properties page, click the Account tab.  A user calls the help desk, the help desk re-enables the account, and a little bit later, the account is locked out again. It's a frustrating experience for both the user and the help desk. Sometimes the problem is exacerbated by the unknown origin of the lockouts. This occurs as follows: 1  Whenever a user account authentication is attempted, the credentials are sent up to the appropriate domain controller for the client system's subnet. 2  If the password is wrong, the client system's domain controller forwards the request to the domain controller holding the PDC emulator role. On a Windows Server 2008 and 2008 R2 domain controller the event ID is 4740. Once you have identified that machine locking your account you can check out the machine and see what's up. In many cases it is a machine you logged onto and lever logged off from. Note this is a successful action as the domain controller was able to successfully lock the account. The field information you want to know is: Target account name-the AD account name. Caller Machine Name-the machine name from where the account was locked out.
http://blog.chrisconklin.com/?p=84 http://itknowledgeexchange.techtarget.com/it-trenches/tracking-down-that-usercomputer-that-locks-ad-accounts/ http://fixmyitsystem.com/2011/02/how-to-find-out-why-your-account-keeps.html http://mikefrobbins.com/2013/11/29/powershell-script-to-determine-what-device-is-locking-out-an-active-directory-user-account/ http://itknowledgeexchange.techtarget.com/it-trenches/tracking-down-that-usercomputer-that-locks-ad-accounts/ http://itknowledgeexchange.techtarget.com/it-trenches/tracking-down-that-usercomputer-that-locks-ad-accounts/ https://technet.microsoft.com/en-us/library/cc719776(v=ws.10).aspx http://www.tomsitpro.com/articles/powershell-active-directory-lockouts,2-848.html http://fixmyitsystem.com/2011/02/how-to-find-out-why-your-account-keeps.html
find out which computer a user is locking an account