Good day,

I am having a problem with my DC accounts, they keep on locking the users out and then i would have to unlock the users. so i am not sure what to do. i have been struggling for months now.

Please assist urgently, as this thing irriatates the hell out of my Seniors when they are locked out.

It may help - Troubleshooting account lockout  http://blogs.technet.com/b/instan/archive/2009/09/01/troubleshooting-account-lockout-the-pss-way.aspx

Hello,

Please check the Anitivirus on Domain controller. If possible run the full scan on DC.

Also check below are those common for account lockout. Run EventCOMBMT.exe tool to find the exact root cause on which machine your account is getting locked.

Event ID 531 : Account disabled
Event ID 532 : Account expired Event ID 535 : Password expired
Event ID 539 : Logon Failure: Account locked out
Event ID 644 : User account Locked out
Event ID 4740: A user account was locked out.(Windows 2008 & Windows 7)

Common cause for Account Lockout

Programs

Service accounts

Bad password threshold is set too low.

User logging on to multiple computers.

Scheduled tasks

Persistent drive mappings

Active Directory Replication

Disconnected Terminal Server Sessions

On the DC security logs look for event id 4740, find the user account in question, this event will record the machine that is locking them out.

From the event logs, you need to identify the source of logon failures. Once done, you need to check what might be wrong with the source system/application. This can help: https://dirteam.com/paul/2012/04/23/user-account-lockout-troubleshooting/

In case of the account lockout I would suggest you to do the following:

First Identity the Source from where the bad credentials are being getting generated, to do that please create the below mentioned group policy at domain level:

Audit Account Logon Events - Success and Failure

Audit Logon Events - Success and Failure

Account Management - Success

Then Enabled the Netlogon logging on all the domain controllers : Please refer the below mentioned article for this.

Enabling debug logging for the Net Logon service :- support.microsoft.com/en-us/kb/109626

The above article works for all the o/s

Let me know once you all above done.