Windows user account gets automatically locked

Question

One of the user accounts on a Windows 2003 server is frequently locked. Each time the "Account is locked" (roughly translated) checkbox is enabled in the Account Properties -> Account tab. The event viewer only mentions that the account is locked, or that I've unlocked it.

However, I don't see any message why the account gets locked in the first place. Are there know reasons why an account gets locked, or is there a way to find out why this happens?

Solution 1

We finally managed to find the cause:

• The local user account has the same name as the server account, but has a different password.

Windows mixes the accounts/passwords somewhere. Changing one of the usernames fixed the problem.

Solution 2

It sounds like someone or a process is trying to login to the account and keeps locking it. You need to enable auditing of failed login attempts.

If your machine is on a domain you can do the following: Audit Active Directory Objects in Windows Server 2003

If your machine is not on a domain, try the following: Logging Failed Log-in Attempts

This should give you an idea of the machine/process that is trying to login as that user.

Solution 3

There are a number of common causes.

• Users who use suspend on laptops and take them on/off the domain.
• People who leave RDP sessions logged on and change their password subsequent to logging on.
• Users who logon to more than one machine at a time and change their password.
• Old credentials stored in user accounts > advanced.
• Scheduled tasks or services with old/incorrect credentials.