[Wadood]

I have an AD account in widows server 2012 R2 which gets locked everyday at 10:00 PM. I am really puzzled of that as I am very sure that I did not create any task using that AD account!
What might be the reason for that ?
Note : when I unlock the account, it works well until 10:00 PM and then it got locked again !

[Advertisements]

if you've enabled security event recording on your domain controller (which you should), you should be able to search for the username in the logon events in event viewer on the DC and see the source of the logon event. compare times (and associated lockout events) and you should be able to find your culprit. contrary to your assumption....I would place a wager that SOME service or task IS in fact using that account if it's getting locked at a predictable time like that.

[dsenette]

if you've enabled security event recording on your domain controller (which you should), you should be able to search for the username in the logon events in event viewer on the DC and see the source of the logon event. compare times (and associated lockout events) and you should be able to find your culprit. contrary to your assumption....I would place a wager that SOME service or task IS in fact using that account if it's getting locked at a predictable time like that.

[Wadood]

Thank you for your reply.
Assuming that I have found the problematic PC which cause the lock, is there anyway to know which services and tasks are using that account ?
Thanks again

[dsenette]

you'll have to dig around to be honest, if it's a service, services.msc has a logon as column. if it's a scheduled task...it should be fairly obvious

[Wadood]

Which account should be logged in to check of services and tasks?
Will be another AD admin account ok ? Or needs administrator account?