AD Accouts locked every 2 hrs

Question

AD Accouts locked every 2 hrs

Edmond (ya) 1

I have the problem of AD account locked out. The locked a/c have around 30 user account in every 2 hrs. Most caller name come from Exchange 2016 host. Try to reboot exchange and AD controller but no luck. Anyone please help to have idea to fix it out?

Hauck, Oliver 1 Reputation point

2021-03-11T12:26:47.907+00:00

I'd suggest to further analyze the security log for related events on that Exchange 2016 host.
Do these users work with OWA? Or do they use Outlook on their mobile devices? Maybe their password is out of sync?
Are these user accounts synced to Azure AD?

1 answer

Your answer

Hauck, Oliver 1 Reputation point

2021-03-11T12:26:47.907+00:00

I'd suggest to further analyze the security log for related events on that Exchange 2016 host.
Do these users work with OWA? Or do they use Outlook on their mobile devices? Maybe their password is out of sync?
Are these user accounts synced to Azure AD?

Answer 1

Anonymous

Hi,
Since you have already find the caller computer , then i would suggest you find the 4625 event on the caller computer.
In the 4625 event will find the caller process.
If there are not 4625events logged , you will need to enable the following audit policy.

Best Regards,

Anonymous

2021-03-15T07:14:55.827+00:00

Hi,

Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

Share via

AD Accouts locked every 2 hrs

1 answer

Your answer