Hello, please check for Conficker Virus also: http://support.microsoft.com/kb/962007/en-us Which OS version, incl. SP/patch level, are you talking about, please provide as much information in your thread to get best help.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hello, use the support tools to check not only the replication: ipconfig /all >c:\ipconfig.txt [from each DC/DNS Server] dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more then one DC exists)] dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045) As the output will become large, DON'T post them into the thread, please use Windows Sky Drive (skydrive.live.com) [with open access!] and add the link from it here. Also the /e in dcdiag scans the complete forest, so better run it on COB.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

The user just reset his password last week and since then has been locked out daily. He has no smart phones or anything authenticating to system or email. He has rebooted his computer several times. What is the first thing aside from eventvwr since it tells me nothing.James

Please download "Microsoft Account Lockout Tools" http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 and try to figure out on which DC user is locked out using "LockoutStatus.exe". Then you can use "eventcombMT.exe" to check event logs on that DC what causes the problem (which server/workstation). Maybe some service is running on that user or workstation is not logged off ? Edit: You may wish to read article about that tools also http://technet.microsoft.com/en-us/library/cc738772(WS.10).aspx Regards, Krzysztof ---- Visit my blog at http://kpytko.wordpress.com

hi , is this issue happenign to single user or multiple users ? Can you verify gpresult to understand if the default domain controller policy is geting applied ? also verify the account lockout threshold

Hello, please check for Conficker Virus also: http://support.microsoft.com/kb/962007/en-us Which OS version, incl. SP/patch level, are you talking about, please provide as much information in your thread to get best help.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

After running lockoutstatus I seen 1 of 3 DC's locked him out 3 times. The logs on the server that has been locking him out shows a lot of AD replication issues. I forced a replication, is there a way to see if the replication worked?James

Hello, use the support tools to check not only the replication: ipconfig /all >c:\ipconfig.txt [from each DC/DNS Server] dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more then one DC exists)] dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045) As the output will become large, DON'T post them into the thread, please use Windows Sky Drive (skydrive.live.com) [with open access!] and add the link from it here. Also the /e in dcdiag scans the complete forest, so better run it on COB.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.