How to troubleshoot frequent account lockouts on Active Directory domain when working remotely?

Jump to latest Follow Reply
H

heartburnkid

Ars Legatus Legionis
10,360
  • #1
    I have a user who works a hybrid work schedule, and experiences a strange issue only when working from home. When he connects to VPN and attempts to open a shared folder, his account is immediately locked out. If I unlock the account, it will happen again the instant he attempts to connect to a drive. This only happens over VPN; on days he is working in office, he is able to work without issue.

    This is the second user now with a similar issue. The first user's issue was resolved by issuing him a new laptop (he was due for a new one anyway), but now that this has affected two users, I'm thinking it might be time to try to figure out a better solution.

    Here's what I've tried so far:

    • Opened Credential manager and deleted the Windows credentials. This did not help.
    • Locked the computer and had the user unlock it. This did not help.
    • Deleted all connections (net use * /delete) and then re-established them. This does seem to help, temporarily; the user is then able to access shared folders without locking himself out for the remainder of the session, but then next time he works from home, the issue returns.

    Any ideas of anything else I can try before I just re-image his laptop?
     
    moosemaimer

    moosemaimer

    Ars Scholae Palatinae
    717
  • #2
    So it only happens if the user attempts to open a pre-existing network share, but works normally if the user recreates the share? I wonder if it's something with cached information, like it's trying to use old data that isn't valid...

    Maybe try using a logon script to rebuild the shares each time the user connects, instead of setting them to be persistent?
     
    H

    heartburnkid

    Ars Legatus Legionis
    10,360
  • #4
    dbwillis said:
    try deleting his profile on the laptop next time hes in the office (delete the registry part, but rename the C:\Users\profileXYZ part to get any needed files down the road) and see if the problem exists?
    Click to expand...

    I know we tried that with the last user that had the issue, and it didn't really help. Might help with this guy, though.
     
    F

    ferzerp

    Ars Praefectus
    5,676
  • #7
    oikjn said:
    or... aren't account lockout rules a bit out of date these days? As malicious actor could use them as an effective DoS attack to perpetually lock a user out?
    Click to expand...
    They are and always have been so, but that doesn't stop them from being implemented or even mandated by regulation still. You just cannot do online authentication attempts fast enough to worry about brute force attacks on passwords of any sane complexity, and even if you could, locking out after a few hundred or even a few thousand failures would mitigate that issue. Locking people out because they had caps lock on 3-5 times or a sticky key is just insane and only creates support tickets.

    Brute force really only works offline against a hash, and lockout policies do nothing there.

    With enough bots, enough internet facing authentication sources (so that just one couldn’t be shut down to mitigate the issue, and an employee directory, and knowledge of the account naming scheme, it would be trivial to wreak operational havoc on an org. It wouldn’t be a difficult recovery, but just the ease of the attack is frightening.



    On topic though, never assume the source of the issue. Track down the failed auth attempts on a DC and work your way back from there.
     
    Last edited:
    You must log in or register to reply here.
    Jump to latest Follow Reply
    Jump to latest Follow Reply