Learn how to identify the source of recurring account lockouts in Active Directory and Microsoft environments.
Introduction
A user account that repeatedly locks out can be frustrating for both the user and the IT support team. While unlocking the account provides temporary relief, the problem will often return unless the root cause is identified and resolved.
This guide explains the most common causes of account lockouts and provides a structured process for investigating and fixing the issue.
Symptoms
Users may report one or more of the following symptoms:
- Unable to sign in despite using the correct password
- Frequent account lockouts throughout the day
- Lockouts occurring shortly after a password change
- Microsoft 365 sign-in failures
- Repeated prompts for credentials
- Mobile devices asking for passwords repeatedly
How Account Lockouts Occur
In Active Directory environments, an account is typically locked after a predefined number of failed authentication attempts.
Common triggers include:
- Incorrect saved passwords
- Outdated service account credentials
- Mobile devices using old passwords
- Network drives using cached credentials
- Scheduled tasks configured with old passwords
- Applications running under user accounts
Common Causes
1. Recently Changed Password
This is the most common cause.
When a user changes their password, some devices and applications may continue using the old password.
Examples include:
- Outlook profiles
- Mobile devices
- Mapped drives
- VPN clients
- Browser-saved credentials
2. Cached Credentials
Windows stores credentials for various services.
If a stored credential is outdated, Windows may repeatedly attempt authentication and eventually lock the account.
Check:
- Saved network connections
- Remote Desktop connections
3. Mapped Drives
Network drives configured with old credentials may continuously attempt authentication.
net use
Look for disconnected or inaccessible network resources.
4. Scheduled Tasks
Scheduled tasks often run using specific user accounts.
If the password changes and the scheduled task is not updated, lockouts can occur repeatedly.
Check:
- Task Scheduler
- Task Properties
- Security Options
Verify the account and password used.
5. Windows Services
Services configured with user credentials may continue attempting to start with invalid passwords.
Review:
Services.msc
Look for:
- Backup software
- Monitoring tools
- Custom applications
- Legacy services
6. Multiple Devices
Many users are signed in to multiple devices simultaneously.
Examples:
- Desktop PC
- Laptop
- Mobile phone
- Tablet
- Virtual desktop
Any device using an outdated password can trigger lockouts.
Investigation Steps
Step 1: Determine When the Lockout Occurs
Ask the user:
- Did the issue begin after a password change?
- Does it happen at specific times?
- Does it occur while working remotely?
- Is it linked to a particular device?
Patterns often reveal the source.
Step 2: Check Domain Controller Security Logs
On a Domain Controller, review Security Event Logs.
Events commonly associated with lockouts include:
Event ID 4740
This event records account lockouts and frequently identifies the originating workstation.
Look for:
- Username
- Caller Computer Name
- Timestamp
Step 3: Identify the Source Device
Once identified, inspect the device for:
- Saved credentials
- Outlook profiles
- Persistent mapped drives
- Scheduled tasks
- Services running under the user’s account
Step 4: Check Mobile Devices
Ask users to:
- Remove affected accounts.
- Re-add accounts using current credentials.
- Update Outlook, Teams, and other Microsoft applications.
Microsoft 365 Considerations
In hybrid environments, lockout issues may involve:
- Azure AD Connect synchronization
- Legacy authentication clients
- Outlook applications
- Mobile devices
- Third-party integrations
Review recent sign-in activity and authentication logs to identify repeated failures.
Security Considerations
Not every lockout is caused by a user mistake.
Investigate suspicious activity if:
- Lockouts occur outside business hours
- Multiple failed sign-ins originate from unknown locations
- Several user accounts are affected simultaneously
- Security alerts accompany lockout events
These symptoms may indicate password spraying or other malicious activity.
Conclusion
Recurring account lockouts are usually caused by a device, service, or application repeatedly attempting authentication with an outdated password. By identifying the source device and reviewing cached credentials, scheduled tasks, services, and mobile devices, most lockout issues can be resolved quickly and permanently.
Rather than repeatedly unlocking the user account, focus on finding the system that continues to submit invalid credentials. Eliminating the source is the key to preventing future lockouts.