Troubleshooting Active Directory Account Lockout

When you have an Account Lockout Policy defined in the default domain policy for the Active Directory domain, you will come across situations where accounts are repetitively locked. This article is intended to simplify the troubleshooting process.

It is important to understand some of the key details in the authentication and lockout process to assist in troubleshooting the problem.

The first step in the troubleshooting process is identifying the source of the authentication failures that caused the Account Lockout. The are several ways that this can be achieved, and there are several tools designed to assist with this process.

We know from the Account Lockout Process that the PDC emulator is responsible for processing the account lockout. It therefore makes logical sense that this should be the first DC that you check in the troubleshooting process.

An alternative and faster method to filtering the windows security event log is to use Windows PowerShell to search the event log. Open an elevated PowerShell console and enter the following code:

While the PDC emulator is the preferable Domain Controller to retrieve lockout information because it is responsible for processing lockouts, the PDC emulator role processes a lot of additional events for the entire domain, including authentication failures, password changes and account lockouts. Because of this, in large environments the windows security event log on the PDC emulator will grow rapidly and depending on the size limit of the event log you may find that the log only holds the last few hours of events.

The Account Lockout Status tool is a combination command-line and graphical tool that displays lockout information about a particular user account. It collects information from every contactable domain controller in the target user account’s domain.

You can download the Account Lockout Status tool here

Now that you’ve identified the source of the account lockout, you need to identify the cause. There are numerous possible causes of authentication failures where an accounts credentials will have been either cached or saved.

For the majority of situations after identifying the source of the account lockout, identifying and resolving the actually cause is a simple process of elimination.

There are a number of tools that can be used to assist in troubleshooting account lockouts, especially in circumstances where the cause can’t easily be identified.