Windows 10: Domain account getting locked - blank Computer name field in event 4740

Dear Support and Community,My colleague's domain account keeps getting locked. I followed steps from the below article on how to use Account Lockout Status tool to find what had been causing the lockout:https://www.manageengine.com/products/active-directory-audit/kb/how-to/how-to-use-account-lockout-status-in-active-directory.htmlI found a few corresponding events 4740 on the domain controller Event Viewer, however all of them have the Caller Computer field blank.I checked events also from other users and all the others had the computer name field populated with their hostnames.My questions ar

:)

 

Getting a domain name...

Just simple 3 steps to make your website glow to millions…
Step 1: Sign up now and get a FREE domain!
Step 2: Design your new website in minutes!
Step 3: You are live! Share your life online!

Click here…

 

Domain Account Locked Daily


Hello,
I have similar problem. My domain account locks from time to time. I just upgraded from W8.1 to W10.
I tried many steps to solve this but none is working.
I found out some interesting things. Using a tool "Account Lockout Status" I found that Last Bad Pwd value is changed when I enter credentials after computer automatic or manaul screen lock out.
I can work normally if I do not get a message about "Windows needs your current credentials":



If I get this message and do nothing - account very quickly locks out.
If I do quick screen lock and unlock it will go ok for some time.
Very strange. I replicate the problem of Last Bad Pwd value using another PC with W10. Some other users in domain are ok some same as mine.
Something wrong with specific users and Windows 10 combination..




Regards,
Gediminas

 

Domain accounts being locked

I have two domain users whose accounts are being locked every 15-30 minutes.

When I check in the domain controller event viewer, it has event ID # 4740.

On the desktop in Windows System event viewer, it has event ID # 40960 - The Security System detected an authentication error for the server cifs/maindc01.FNBSAL.com. The failure code from authentication protocol Kerberos was "The user account has been automatically
locked because too many invalid logon attempts or password change attempts have been requested.

(0xc0000234)".

The user didn't enter an incorrect password and isn't logging on anywhere else.

We use Group Policy to assign drive mappings, so I'm not sure if that was causing anything, so I ran gpupdate /force on her computer and it came back with an error saying Group Policy couldn't be updated due to GPO network drive mappings. I can attach the
error if needed.

Any help with this would be appreciated.

Thanks.