Account Lockout

[Guest]

After I changed the password on a service account, the account is being
locked and I can't figure out which computer is using the account or how it
is being locked. When I go back to the old password the account is fine. Can
any one offer any help in solving this problem. Thanks in advance.

 

[Herb Martin]

After I changed the password on a service account, the account is being
locked and I can't figure out which computer is using the account or how
it
is being locked. When I go back to the old password the account is fine.
Can
any one offer any help in solving this problem. Thanks in advance.

Try "Account Logon Auditing" to record these logon errors
and help troubleshoot the source.

 

[Tim.Olsen]

Use EventcombMT.exe to search for security events 529, 644, 675, 676,
and 681 with your account name in the text.

You can find EventcombMT and some other lockout tools here:
http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en

 

[onone]

From the EventComb logs you can search for the user name, this usually
points to a DC.

Run EventComb account lockouts against the DC where the account was
locking out and you should have a new log with the exact IP address of
where the account is locking out.

It should be noted that you could also assume the account is used to
run the same service on all machines where the application is
installed, therefore you will nedd to go and change the password on the
same service on all those machines.