hi everybody
i have got a strange situation here
in our network every once in a while, some user would get the message that he should contact the sys admin because the account is disabled. when i loged in to the AD users and computers, the account was always enabled. i would disable it and the enable it again and everything worked fine after that.
since yesterday, all of a sudden many accounts disabled at the same time. active directory show them enabled, but they can not log and get the message that the account is disabled. i keep disabling and enabling them to make them work, but after half to one hour, the same account does the same thing and i have to disable and enable it again. very strange, please help/suggestionsregards
My first suspicion would be your workstations have been compromized and someone is trying to hack your server which results in the lockout. You should review the security event viewer logs to determine why the lockouts are occuring.
the strange thing is that the accounts are not really locked out. they just start working again only if i enable and disable the account.
have checked the eventviewer but there is nothing there because the accounts are not really disabled. the user gets an error message that it is disabled
You need to figure out the source of the message. Perhaps a local workstation password policy?
Ad Choices