Domain Account keeping locking out with correct password every few minutes

Asked 2010-12-17T08:04:12.300

I have user whos account is keeping locking out every 30 minutes. Done all the checks, remove any cache passwords, created new profile, delete password from IE.

It locks out even when user is using his account (he is logged in )

After checking 20 servers I found that they is service running which causing his account to lock I think.

675,AUDIT FAILURE,Security,Thu Dec 16 07:54:04 2010,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name:  userid     User ID:  %{id}     Service Name:  krbtgt/DOMAIN     Pre-Authentication Type: 0x2     Failure Code:  0x12     Client Address:  IP address

Does anyone know what is this.

krbtgt/DOMAIN     
Key Distribution Center Service Account

Can some please explain this to me why this is happening and how i can fix this.

675,AUDIT FAILURE,Security,Fri Dec 24 09:13:01 2010,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name:  user_id    User ID:  %{id}     Service Name:  krbtgt/Domain     Pre-Authentication Type: 0x2     Failure Code:  0x12     Client Address:  172.16.5.1    
675,AUDIT FAILURE,Security,Fri Dec 24 08:49:06 2010,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name:  user_id    User ID:  %{id}     Service Name:  krbtgt/Domain     Pre-Authentication Type: 0x2     Failure Code:  0x12     Client Address:  172.16.5.102    
644,AUDIT SUCCESS,Security,Fri Dec 24 08:49:06 2010,NT AUTHORITY\SYSTEM,User Account Locked Out:     Target Account Name: user_id    Target Account ID: %{id}     Caller Machine Name: UKNML3266     Caller User Name: LONDON$     Caller Domain: Domain     Caller Logon ID: (0x0,0x3E7)    
675,AUDIT FAILURE,Security,Fri Dec 24 08:49:06 2010,NT AUTHORITY\SYSTEM,Pre-authentication failed:     User Name:  user_id    User ID:  %{id}     Service Name:  krbtgt/Domain     Pre-Authentication Type: 0x2     Failure Code:  0x18     Client Address:  172.16.5.102    
675,AUDIT FAILURE,Security,Fr


                    
                    
                        
                        windows
                        
                        active-directory
                        
                        windows-server-2003
                        
                    
                    
                        
                        
                        
                        
                        
                        Edit
                        
                        
                        
                            
                        
                        
                        Report



        
            4 Answers
            
            
                
                    
                        
                            
                            
                        
                        2
                        
                            
                            
                        
                        
                    
                    
                        
                        You need to make sure that the clocks on all your servers are correct. Kerberos errors are normally caused by your server clock being out of sync with your domain.

UPDATE

Failure code 0x12 very specifically means "Clients credentials have been revoked", which means that this error has happened once the account has been disabled, expired, or locked out.

It would be useful to try and find the previous error messages if you think that the account was active - i.e. this error message may not be the root cause, you will have different errors preceding this error, which cause the account to get locked.

Ideally, to get a full answer, you will need to reactivate the account and keep an eye on the logs for an error occurring before the 0x12 error messages.

                        
                        
                            answered 2010-12-17T08:34:49.483
                            
                        
                        
                            
                                
                                
                            
                        
                        
                            
                            
                            
                                
                                
                            
                            
                        
                    
                
            
            
            
                
                    
                        
                            
                            
                        
                        1
                        
                            
                            
                        
                        
                    
                    
                        
                        I have seen this problem when the user had set up a scheduled task to run under his account.  He forgot to update the password on the task after he changed his account password.  The scheduled task was trying to logon with the old password and kept locking out his account.

                        
                        
                            answered 2010-12-20T14:47:08.760
                            
                        
                        
                            
                                
                                
                            
                        
                        
                            
                            
                            
                                
                                
                            
                            
                        
                    
                
            
            
            
                
                    
                        
                            
                            
                        
                        1
                        
                            
                            
                        
                        
                    
                    
                        
                        May be the virus by name CONFLICKER try d.exe tool from symantec on the machine hope your problem will be resolved.
Check the security logs in domain controller and scan those machines because of this virus it creates bad passwords and lock the users.

                        
                        
                            answered 2013-03-02T07:55:19.177
                            
                        
                        
                            
                                
                                
                            
                        
                        
                            
                            
                            
                                
                                
                            
                            
                        
                    
                
            
            
            
                
                    
                        
                            
                            
                        
                        -2
                        
                            
                            
                        
                        
                    
                    
                        
                        If your computer is on a domain, you can see Windows Password Rescuer Advanced,  http://www.daossoft.com/documents/how-to-reset-windows-domian-account-password.html

                        
                        
                            answered 2011-10-28T02:42:19.920
                            
                        
                        
                            
                                
                                
                            
                        
                        
                            
                            
                            
                                
                                
                            
                            
                        
                    
                
            
            
        

        
        
            Your Answer