Config Helper

Active Directory Account Lockout Troubleshooting

Written by admin on June 17, 2010 – 2:24 pm -

If you are troubleshooting why an Active Directory account is being locked out randomly or if you need additional password information for a specific account  then there is a great free utility you can use that will help you. The tool is part of the Windows 2003 Resource Kit and can be downloaded from the Microsoft site. Once you download the Resource Kit, the specific utility you want is called acctinfo.dll. Copy acctinfo.dll from the location of the Resource Kit install (by default: C:\Program Files\Windows Resource Kits\Tools) to the system32 folder (C:\WINDOWS\system32). After you copy the file then run this command to register the dll - regsvr32 c:\windows\system32\acctinfo.dll

 

The tool is now installed and can be accessed from Active Directory Users and Computers snap-in. When you view the properties of a user there will now be a new tab called Additional Account Info.

When you click on the tab, you will see a ton of information that was not previously available, at least not easily available. The fields you will see are Password Last Set, Password Expires, whether the account is currently locked out or not, Last-Logon-Timestamp, SID, GUID. You will also see the Last Logon and Last Logoff time, the Last Bad Logon time, the number of times that user has logged onto the domain under Logon Count, and then the current Bad Password Count. Keep in mind that the Bad Password Count will reset according to the password policy in effect on the domain. Also, if you click the Domain PW Info… button you will see the Domain Password Policy.

There is a great deal of information available with this utility and it is great for tracking down annoying lockout issues. Using the Last Bad Logon information, you can think about what scheduled tasks might be running at that time that is using a certain account with an old expired password, possibly a service account running a scheduled job. Hopefully you found this information useful and please take time to review our other articles. Additionally, if this article has helped you then please feel free to link back to it or to the ConfigHelper site.

Tags: account lockout, acctinfo.dll, Active Directory, bad password, last logon, windows resource kit
Posted in Active Directory, Software Configuration, Windows | 4 Comments »