I have frequent problems where users accounts are locked out after changing passwords. I know users have probably set up a scheduled task or mapped a drive or some such. However my users do quite a bit of hot desking, is it possible to tell what PC or IP address is locking the account out so that I can then identify the problem?

Hello, you could either go through the logs of all domain controllers to find out where and by what computer the account is being locked out or you could use a tool to do this for you. Here is a tool by Microsoft which should be able to assist you in finding out why an account is being locked out: Account Lockout and Management ToolsJaap Brasser http://www.jaapbrasser.com

Below is the simple way to check from which computer account is getting locked 1. Download microsoft lockout status tool from below link http://www.microsoft.com/en-us/download/details.aspx?id=15201 2. Install it on domain controller 3. Put the target name (user account which is getting locked) on target tab 4.It will list out Date/time and DC on which account lock out events are happening 5.Check the Latest date and time and DC name,. Login to the DC where the evet is getting generated. 6.Go to security event------>search for 644 (microsoft Server 203) or 4740 (W2K8)----->open the event 7.It will list the account information and Computer name from which account is gettng locked 8.Login to the computer and check for any services or schduled task Hope this information helps Regards, _Prashant_MCSA|MCITP SA|Microsoft Exchange 2003 Blog - http://prashant1987.wordpress.com Disclaimer: This posting is provided AS-IS with no warranties/guarantees and confers no rights.

Hello, Check events related to the lockouts in the event viewer of your DCs so that you check the source of logon attempts. Once identified, you can check if there is a service / application running under your user account with a wrong password. Details in Paul's article: http://blogs.dirteam.com/blogs/paulbergson/archive/2012/04/23/user-account-lockout-troubleshooting.aspx This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

The above respondent's advice is good, Any updates for your issue?Jeff Ren TechNet Community Support beneficial to other community members reading the thread.

this just show johnny has been locked on on dc1 I don't see any more info? ie which PC or server johnny is trying to log on from

We have the exact same issue at our end. If you find a solution, please share it with the others. :) //Elmeholt

this just show johnny has been locked on on dc1 I don't see any more info? ie which PC or server johnny is trying to log on from Hello, Did you follow the steps which I have mentioned in my previous post? It will let you know source from where user account is getting locked Regards, _Prashant_MCSA|MCITP SA|Microsoft Exchange 2003 Blog - http://prashant1987.wordpress.com Disclaimer: This posting is provided AS-IS with no warranties/guarantees and confers no rights.