Hello, I'm having an awful time trying to track down what is causing an account lockout on AD (2008R2) at roughly the same time each day for 30 mins. It's been occurring for weeks. It's not the same time each day (can vary by about 20 mins), so I don't think (but could be wrong) it's a Scheduled Task. From the several thousand servers and many more workstations, where do I begin to search for the culprit causing the problem? BTW, the account happens to be a Domain Admin acct. After 30 mins of lockout time, the account is OK again and functions fine for the next ~23.5 hours. Thankyou, John Bradshaw

Hello, please check all scheduled tasks as already mentioned and also the services on the servers. There seems to be the account used and the password is not correct on the server. Also the account lockout tools may help you: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=18465 http://technet.microsoft.com/en-us/library/cc738772(WS.10).aspx http://www.pbbergs.com/windows/articles/UserAccountLockoutTroubleshooting.html http://support.microsoft.com/kb/109626Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hello, please check event viewer and identify the source computer. Once done, check if there is a service / computer running under this account with a wrong password. Another possible cause is viruses and attacks on domain accounts. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Run the MSRT to remove the confiker. http://blogs.technet.com/b/rhalbheer/archive/2009/01/13/additional-information-on-conficker-msrt-removing-conficker.aspx Thanks

Thx everyone. I don't think there is a virus. I shall have a look at the tools suggested above and let u know how it goes. John Bradshaw