One account locked every 5 minutes

[blin]

One of our Mac user accounts is locked every 5 minutes. She only uses Outlook 2011. I try to check Security Event, but there are so many information. How can we find what cause the problem? I try to filter computer name, ip address, or user name, but can't find many useful information. How do you troubleshoot this problem?

[blin]

Before moving on, let’s clarify:

Just as you mentioned, the MAC user account, do you mean this user need to logon MAC computer? But be created in the Windows Domain?

From the windows perspective, we need to analyze the Netlogon log, and security log, combing with the Kerberos log.

You can send me security log, before that please compress this security log, and then send it to my mail v-dezhan@microsoft.com

Another question, we should gather the security log on DC, since the user authenticated against the DC, so please gather the security log on DC and then compress it, and then send it to my mail.

At the same time, please tell us the MAC account name, and logon computer.

[blin]

An account was logged off.

Subject:

Security ID: S-1-5-21-1755198840-261371301-314601362-1511

Account Name: JMcCaffrey

Account Domain: N****IN

Logon ID: 0xa2d827aa

Logon Type: 3

An account was successfully logged on.

But, they are all representing this MAC account can logon DC correctly without any error, and any lockout issue.

So, I am a little confused about your mentioned MAC account issue, then let’s see the following question:

1.First, does this MAC account can logon to the Windows client correctly?
2.Where did you find this MAC account be locked in every 5 minutes?
3.Does this MAC Host join to the Domain?
As the troubleshooting steps, please consider the following methods:

1.Please download the Account Lockout and Management Tools, and then use the following article to analyze:
Account Lockout and Management Tools

http://www.microsoft.com/en-us/download ... x?id=18465

Account Lockout Tools

http://technet.microsoft.com/en-us/libr ... 72(v=ws.10).aspx

1.Enable the netlogon log on all Domain controller:
Enabling debug logging for the Net Logon service

http://support.microsoft.com/kb/109626/en-us

1.After the account be locked out, we should check the netlogon log and Event 529, 644, 12294 and 4625 in security log.
Thanks,


--------------------------------------------------------------------------------