This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(227.2, 5%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMG%3C/text%3E%3C/svg%3E)
I need help troubleshooting repeated AD account lockouts that occur after a computer is restarted, sleeps, or is locked. Many users in my company are facing this issue, and I don't know what initiates it. Every time this happens, I have to unlock their user from Active Directory. All the users' OS are Windows 10, and the AD is Windows 2019. i have reviewed the local and dc event logs but i can only find the last event which is the locked out event, i was expecting to see the attempts before lockout but there are not any. Can someone help me solve this problem? Thank you in advance.
Thank You @Gary Reynolds . i have found that the log size was too low that by the time we review the logs they are already purged. So i increased the log size for the security events and now i can see the attempts. Most of the attempts show that they are type 2(interactive logon) but they users don't know about that. The only relationship i can find between all the locked out accounts due login failure is that the LoginID is 0x3E7. do you have any idea about that?
Can you share the details of the event log entry?
The logonid of 0x3E7 is for the local service account.
Have a look at this article, which will identify where accounts are getting locked from. https://nettools.net/troubleshoot-account-lockouts/
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more