Do you have multiple domain controllers and multiple sites in your
environment? Sounds like you may have replication latency issues and are
viewing the status of the computer from a DC that currently has not
recieved information about the account lockout status.
The following Microsoft website provides a great deal of information
regarding account lockouts - how they work and how to troubleshoot them.
Account Passwords and Policies
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechn
ol/windowsserver2003/maintain/operate/BPACTLCK.asp
At this site you can click on the link for Account Lockout Tools. There is
a tool called acctinfo.dll that you can install on a workstation, server or
DC (wherever you wish to run it), which adds an additional property page to
the user accounts. After registering this DLL you simply double-click on
the user account in AD Users and Computers and select the new user property
page labeled Additional Account Info. At the bottom is a button labeled
"Account Lockout Status" which you click on to see the user's computer
account status on all Domain Controllers. You can see which DC has the
account status as locked and which DCs have yet to have that information
replicated to them. This will allow you to select the DC where this
account is locked and unlock it without having to perform additional steps
to see that information.
Even after performing this, you will note that you cannot currently use the
Find feature in AD Users and Computers to locate the user account and get
the additional property page information. You will need to go directly to
the users container and double-click on it to see the property page. We
have an updated version of the DLL file that will be released later that
allows it to work properly with the Find feature for added convenience.
David Pharr, (e-mail address removed)
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Content-Class: urn:content-classes:message
| From: "Naresh Tamak" <
[email protected]>
| Sender: "Naresh Tamak" <
[email protected]>
| Subject: Active Directory Users and Computers
| Date: Wed, 19 Nov 2003 16:18:53 -0800
| Lines: 12
| Message-ID: <
[email protected]>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| Thread-Index: AcOu++FKn9DSP+CkRCeU8Lddk7T9pA==
| Newsgroups: microsoft.public.win2000.active_directory
| Path: cpmsftngxa07.phx.gbl
| Xref: cpmsftngxa07.phx.gbl microsoft.public.win2000.active_directory:56486
| NNTP-Posting-Host: tk2msftngxa09.phx.gbl 10.40.1.161
| X-Tomcat-NG: microsoft.public.win2000.active_directory
|
| All,
|
| I do not see the user account is locked out in Active
| Directory Users & Computer but we know that the account
| is locked out. If user reboot the machine then it appears
| in Active Directory User & computer snap shot that the
| account is locked out
|
| Is there is any fix for it?
|
| Thanks
| Naresh Tamak
|
