Account lock out in Exchange server 2016 DAG environment with AD

Question

Tracing account lock out by event viewer shows that IP source is Exchange server or domain controller. Tracking done by event 4740. Accounts are continuously being locked out how can we trouble shoot this further I used Microsoft Account lockout tool but it has very limited information about source IP

Answer 1

Hello @azhar Nasim

Thank you for using Q & A forum.

This event ID will contain the source computer of the lockout.

Refer to the below link solution already provided.

Using PowerShell to Find the Source of Account Lockouts

1. Open the Group Policy Management console. This can be from the domain controller or any computer that has the RSAT tools installed.
2. Modify the Default Domain Controllers Policy

---

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Answer 2

Hello there,

I'd recommend going into your IIS logs and finding the timestamp of that event to locate the IP address. Check to make sure Pop3 / IMAP hasn't been enabled in exchange, for an old phone or such.

A lot of the lockouts will be cached credentials in windows in credential manager. You can try to remove the local Windows credentials and see if the problem persists.

Copy the below line

rundll32.exe keymgr.dll,KRShowKeyMgr

Windows Key+R > CTRL+V to paste the above-copied line and Enter

Here you can delete the stored passwords

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer–