Yesterday I faced a problem with active directory, all users account locked out frequently, So I just thought to share this issue with you, Please find the details of that issue and how we rectified.
Problem
All users account locked out frequently, if I unlock also again and again it was locked out frequently.
Solution for this issue
1) First I downloaded one unlock.exe file, it’s a very good tool for unlock user account for locked accounts
2) we can download this file from http://www.joeware.net/freetools/tools/unlock/index.htm
3) Once downloaded this file put it into separate folder and in the same folder we have to create a batch file with a small script
4) Here is the way how to create the batch file with script
5) Open a notepad and type this script
cls
@ECHO OFF
unlock brigadedc *
unlock brigadeadc *
6) instead of giving brigadedc and brigadeadc you should give your DC and ADC name
7) Save this script as unlock.bat in the same folder which one we downloaded and put it into separate folder
8) Now we need to run this batch file for unlock the users account automatically, so that users will not face the problem with their work.
9) For that we need to schedule this task, go to control panel and select scheduled task
10) Add a new scheduled task and click next and click browse and select the unlock.bat file which one we created and saved the scripts
11) Perform this task on daily and give the user name and password with domain admin privileged account name
12 Select the tick mark for advanced settings, In advanced scheduled options we have to select Repeat task and run this task Every 1 min, So that this will run in every 1 minutes and will unlock all account for this one minitue period, so that user will not face any locked out problems.
13) Now account locked out we rectified, but we should solve the issue why all accounts are locked frequently
14) First we need to enable the audit policy (both success and failure policy)
15) Go to Domain controller policy and Local policy ----Audit policy---Define these all policies success and failure, So that we can see the logon attempt failure audits
16) Once we done this..Go to Event Viewer in DC, Select security and see the audit success and failure, there must be some failure audits
17) Find out the failure audits and track the ip address and host name of the machine which one is giving failure audit logon attempts failure
18) I got 3 failure audit for logon attempt failure in security event, I tracked that 3 machines and put it into virus scan, But unfortunately our Symantec AV found one virus but unable to quarantine or delete this virus
19) So I taken backup of these 3 machine and formatted this 3 machines
20) Now the entire virus gone and the users account came normally (not locked out), Remove the scheduled task, now its working fine.
Note : The virus name is W32 conflicker.exe, Later I realize that the virus is generating from Symantec only, the reason is our Symantec AV product was expired 3 months back and now we are using Symantec 11 trial version, for purchasing the new license Symantec may create the virus and sending to client machines!!!!
Microsoft is giving a new updates for preventing these kind of Malwares, Please find the link and please suggest our colleagues to install on all our client machines
http://www.microsoft.com/downloads/thankyou.aspx?familyId=0d5f9b6e-9265-44b9-a376-2067b73d6a03&displayLang=en
http://www.microsoft.com/downloads/details.aspx?familyid=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en
But its not removing any virus, only it will prevent from virus.
Thanks & Regards
Radhakrishnan R
