How to find the source of a locked out account in Windows Server 2008 R2 / Windows 7

How to find the source of a locked out account in Windows Server 2008 R2 / Windows 7
Check in the DC, for event 4771 in the Security Log:

From the Client Address, you found the source of the problem.
Log into the client, check the event log/security log:



Here you can see a stored password is causing the problem. Delete the entry from the Stored Passwords app (Control Panel/User Accounts/Manage my network passwords).


Comments

  1. ComputerMan richard-artes.infoMay 18, 2016 at 3:15 AM

    You can also use the Microsoft Account Lockout and Management Tools (ALTools.exe). Thanks to James for pointing this out!

    ReplyDelete

Post a Comment

Popular posts from this blog

Server Manager will not start, error .NET Framework: "This application requires one of the following versions of the .NET Framework:"

Server Manager will not start on Windows Server 2019 after installing ADConnect. Error ServerManager.exe: This application could not be started. .NET Framework: "This application requires one of the following versions of the .NET Framework:xxxxx Do you want to install .NET framework now?" Of course it's already installed automatically on the server, so if you try and install it again you can't, error "already installed". Try the .NET repair package, can't repair the install. Try dsim.exe to install the package, error "Microsoft .NET Framework is already part of this installation". .NET Runtime version : 4.0.30319.0 - This application could not be started.This application requires one of the following versions of the .NET Framework:  v4.0.30319 The answer is to re-create the registry entries deleted when you installed ADConnect:- [HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319] "AspNetEnforceViewStateMac"=dw...
Read more

Start virtualised domain controller in DSRM (Active Directory Restore Mode).

If you have a totally virtualised Active Directory infrastructure in Hyper-V, you can't boot the VM into  Directory Services Restore Mode  using F8. The keypress is not recognised. To get around this, in a elevated command prompt, type: bcdedit /set {globalsettings} advancedoptions true Now when you reboot the DC, it will ask if you want to boot into restore mode, and you can restore A.D. After rebooting, type the command: bcdedit /set {globalsettings} advancedoptions false and it will boot normally again. Now you have to find the restore mode password....
Read more