random users account locked frequently and hits active direcorty service by unknown users which is not stated in directory services

Sandeep Kumar 1 Reputation point
2020-08-05T12:22:30.43+00:00

we have installed ad plus tools which is show unknowns users attempt login wih bad password users name , and some also users of active directory attempt login with bad password shown by ad plus tools. when we have enabled lockout policy on domain controller users are frequently locked out

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
6,149 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Fan Fan 15,321 Reputation points Microsoft Vendor
    2020-08-06T02:41:02.013+00:00

    Usually, for troubleshooting account lockout issue, we should follow the general troubleshooting steps below. For your reference :
    1. Enable audit policies for each DC then gather audit event from PDC. Check the vent 4740.
    To configure the audit policy under
    [Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit account management] 
    2. According to the audit events on PDC determine which clients or DCs sent the failed authentication request. If the failed authentication request was sent by a DC, then we should gather the audit event on the DC. So we can find out which clients sent the BAD password.
    3.  After we get the workstations IP, then we need enable Audit Logon Events – Failure and Audit Process Tracking for this client, then analyze the event log to find out which process or apps send the BAD password.

    15925-8063.jpg
    Note: we need increase security log size before we enable audit. It will overwrite previous log when the security log size is so small.

    Account lockout troubleshot link:https://social.technet.microsoft.com/wiki/contents/articles/23497.active-directory-troubleshooting-frequent-account-lockout.aspx

    Fan