Re: Account lockout - leads to Exchange server

Tech-Archive recommends: Fix windows errors by optimizing your registry

gbug wrote:
Yes, i am aware of those resources, and am mentioned have tried them
and traced down the culprit to be the exange server. This says to me
there is a mail client on the network with stored credentials.
My questions is - how do i find this device?

Mobile device (phone with IMAP/POP maybe), OWA, OA on a home computer?.

Not aware of any specific tools, but narrowing the user device possabilities
might make looking through logs easier.


"Marcin" wrote:

try the following:

Account Lockout Tools
http://technet.microsoft.com/en-us/library/cc738772.aspx

Troubleshooting Account Lockout
http://technet.microsoft.com/en-us/library/cc773155.aspx

hth
Marcin

"gbug" <gbug@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:E2AED083-A644-447E-A9E8-1D2C7EE080A5@xxxxxxxxxxxxxxxx
Hi all,
I have a user who has recently changed their password, and since
then, every
15 mins the account is locked out. Our password policy says that 5
bad attempts = lockout.
I have run event comb on the domain controllers, and found that
searching for AccountLockouts does not come back with anything. But
if i manually search for a failed security audit, i find this user
listed with Category

Account Login; Failure Audit.
Problem is, the source workstation the event points to is the
corporate Exchange server. This says somewhere, the users
credentials are saved to some
mail client which checks every 15 mins - but i dont know WHICH
workstaion/device this is coming from.
Are there any other tools to help me find out where this is coming
from on the network? I have already asked the user to use another
workstation, and turn theirs off completely to rule it out, yet the
problem persists.
I have also used the account lockout tools, but i am no closer.
Cheers!

--
/kj


.

Relevant Pages

  • Re: Account lockout - leads to Exchange server
    ... You need to isolate the type of mailbox access first, ... Troubleshooting Account Lockout ... the source workstation the event points to is the ... I have also used the account lockout tools, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Account lockout - leads to Exchange server
    ... Troubleshooting Account Lockout ... the source workstation the event points to is the ... problem persists. ... I have also used the account lockout tools, ...
    (microsoft.public.windows.server.active_directory)
  • Re: NT User A/C Lock
    ... credentials in network shares, XP stored credentials. ... controllers will show account lockout events and the domain computers will ... record a logon failure due to an account lockout. ... Event Comb to search your computers and domain controllers for specific ...
    (microsoft.public.security)
  • RE: after password changes screensaver locked account out
    ... Have you tried using the Account Lockout Tools (LokoutStatus.exe, ... please refer to the following links: ... Some user are then unable to login again when the screensaver was running. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Account lockout - leads to Exchange server
    ... traced down the culprit to be the exange server. ... Troubleshooting Account Lockout ... the source workstation the event points to is the corporate ... I have also used the account lockout tools, ...
    (microsoft.public.windows.server.active_directory)