Hi everyone
I've got a weird issue here where one of our DC's would lock one specific user out everyday at 10 am and 2 pm. The reason I say it is the DC is because I had a look in the Event viewer on the DC that reported the lockout and found the following
675,AUDIT FAILURE,Security,Tue Jul 15 10:01:09 2014,NT AUTHORITY\SYSTEM,Pre-authentication failed: User Name: ******** User ID: ******** Service Name: krbtgt/******* Pre-Authentication Type: 0x2 Failure Code: 0x18 Client Address: 192.168.10.40 Certificate Issuer Name: %7 Certificate Serial Number: %8 Certificate Thumbprint: %9
The DC that keeps locking the account out has the 10.40 address.
I have also used the Netwrix Account lockout Examiner but everything checked out OK except for the Examine Invalid logons
I am kinda stumped, I can't find anything on the DC that would use the...