User Manager service in windows 10 is causing frequent lockout and need assistance in fixing this

Question

We are facing frequent lockout issues and upon checking our AD server the computer name is blank. So, checked the 4625 logs(unknown user name or bad password) on user computers and it pointed to svchost.exe which in turn pointed(process id) to User manager service. We use windows 10 and noticed that if this service is disabled and web account manager service is stopped, there are no lockout logs. However, when the pc is rebooted the pc goes blank and the task bar flashes. Please help me fix this issue with this service as it seems an important service as well as the service causing the issue. The PC has already been rebuilt as a last resort and we still see this issue. Also, this is happening with a lot of users in the company. Please let me know if more info is required.

Answer 1

Hello

Thank you for your question and reaching out.

These are the common reasons for account lockouts:

1. User error (typing the incorrect username or password)
2. Programmes using credentials that are cached or active threads using outdated credentials
3. Passwords for service accounts that the service control manager has cached
4. Multiple computers are used by the same user, or disconnected remote terminal server sessions

arranged tasks

5. mappings for persistent drives
6. Replication in Active Directory took longer
7. Task Scheduler or Services running with Old password.

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hi There, we were able to find the root cause from the 4625 logs on user's PC pointing to User manager service and we are stuck on how to proceed. User manager cannot be disabled as thr pc goes blank after a reboot with this service being disabled

Answer 3

See this link and resolve , GPO settings possibly causing an issue

https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/account-lockout-duration