How to find the cause of locked user account in Windows AD domain
- by Stephane
After a recent incident with Outlook, I was wondering how I would most efficiently resolve the following problem:
Assume a fairly typical small to medium sized AD infrastructure: several DCs, a number of internal servers and windows clients, several services using AD and LDAP for user authentication from within the DMZ (SMTP relay, VPN, Citrix, etc.) and several internal services all relying on AD for authentication (Exchange, SQL server, file and print servers, terminal services servers). You have full access to all systems but they are a bit too numerous (counting the clients) to check individually.
Now assume that, for some unknown reason, one (or more) user account gets locked out due to password lockout policy every few minutes.
What would be the best way to find the service/machine responsible for this ?
Assuming the infrastructure is pure, standard Windows with no additional management tool and few changes from default is there any way the process of finding the cause of such lockout could be accelerated or improved ?
What could be done to improve the resilient of the system against such an account lockout DOS ? Disabling account lockout is an obvious answer but then you run into the issue of users having way to easily exploitable passwords, even with complexity enforced.
