Troubleshooting Frequent Account lockout

Most of the users account will get locked from locally desktops and Mobile devices or idle sessions left on Server / workstation, We need to start Account lookout troubleshooting from below order.
  1. Client side troubleshooting
  2. Mobile devices
  3. Server side  troubleshooting
Client side
Perform the below steps on client side (Local desktop / Laptop)
  • Clear Temporary Files
  • Delete Cookies ->Temp Files -> History -> Saved passwords -> Forms from all the Browsers.
  • Start — > Run –> Temp –> Delete all temp files.
  • Start –> Run –> Prefetch –> Delete all Prefetch files.
  • Remove Mapped drives from my computer.  My Computer –> Right click on Shared drive –> click on Disconnect
  • If Adobe reader is installed, backend it will be trying to check for latest update, Delete the Adobe updater file from below path. Delete the AdobeUpdater.dll file in the folder C:\Program Files\Adobe\Reader version \Reader
  • Remove stored passwords from Control Panel
  • Start –> Run –> Type Control UserPasswords2 , Click on Advanced managed passwords and delete all the passwords
  • Remote unwanted applications from startups (Run-> msconfig –> startup –> Uncheck unwanted software’s)
  • Scan the entire HDD and update the Antivirus agent
  • Check the third party software’s installed on client side, If it’s not required, Uninstall.
  • Open the Task Scheduler (Run --> Tasks) and delete the unwanted tasks. Most of the time, Automatic backup / Google Update / Apple Updates will be installed by default) Remove all.
  • Uninstall Auto update software’s in control panel (You can update these software’s manually)
  • If user’s account acts as a service account (Update the latest password in Service).
  • Check if User’s account used as an IIS application pool identity.

Mobile Devices

Perform the below steps on Mobile devices / Smart phone (BYOD)
 If user recently changed password and forgot to update in Mobile devices, that cause the account lockout  sometime for user ID,Does user involved has a smartphone or some kind of mobile device using AD credentials for connecting (like exchange), if it fails to connect 5 times (depending on your GPO’s), it locks his account. Have a look on all his stuff using his user account automatically, specially his mobile (90% of the time guilty).
  • Go to account settings in Mobile device and update the latest password.
  • Reboot the device if required.
  • Is issue persists, Delete and reconfigure the device,
  • If you found that account is getting locked from mobile device, and unable to fix the by performing above steps, Take necessary backup and Wipe the device completely and reconfigure the device.

Server / Active Directory

User below tools to find out source of the account lockout - On Server
  1. Account Lockout and Management Tool.http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 

Comments

  1. Jenyford smithNovember 2, 2021 at 11:59 AM

    I really be grateful for your blog,Wellington towing service you have completed the great job. Thanks for the bunch of excellent resourceful site.

    ReplyDelete

Post a Comment

Popular posts from this blog

Enterprise CA option is greyed out / unavailable

Many times, when installing Active Directory Certificate Services they cannot choose to install Enterprise Certification Authority, because it’s unavailable as in following picture: Well, you need to fulfill basic requirements: Server machine has to be a member server (domain joined). You can run an Enterprise CA on the Standard, Enterprise, or Data Center Windows Edition. The difference is the number of ADCS features and components that can be enabled. To get full functionality, you need to run on Enterprise or Data Center Windows Server 2008 /12/R2/ Editions.  In order to install an Enterprise CA, you must be a member of either Enterprise Admins or Domain Admins in the forest root domain (either directly or through a group nesting). If issue still persists, there is probably a problem with getting correct credentials of your account. There are many thing that can cause it (network blockage, domain settings, server configuration, and other issues). In al...
Read more

Rearm the Office 2013 installation

Image
There is a 25-day grace period from the time of installation of Key Management Service (KMS) clients before notifications to activate are displayed to the user. If you want to deploy an image, you must rearm your Office 2013 installation before you capture the image. If you do not rearm, users see notification dialog boxes at the time that the image is deployed, instead of 25 days after deployment. The 25-day grace period gives ample time for a KMS host to be found and activation to succeed. If activation is successful, users do not see notifications to activate. Rearm the Office installation Rearming does the following important tasks: Resets the grace timer to 30 days. Freezes the grace timer until either an Office application is run, or the ospp.vbs script is run. Resets the client computer ID (CMID). This is important because the KMS host uses the CMID to determine the num...
Read more

MP has rejected registration request due to failure in client certificate

Image
Issue:- We have System Center Configuration Manager 2012 R2 deployed on Windows Server 2008R2 host. Recently we have moved our Certification Authority to Windows Server 2012 , renewed Root CA Certificate and intermediate Certificates also migrated Hashing algorithm from 'sha1' to 'sha2'  . New Root CA and intermediate CA also present on client machines and on SCCM. However, i have discovered these errors on MP: MP has rejected registration request due to failure in client certificate (Subject Name: ) chain validation. If this is a valid client ,  Even though Newly imaged machines are getting SCCM client installed but won't see all the client cycle under 'Actions tab' and also  'client certificate shows "None".  The operating system reported error 2148204809: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.  Solution:- Register  new Certificate of Root CA    under SCCM20...
Read more