Windows 10: Event Viewer showing account lockout alerts 4740 from computers which are not in my domain...

Hi guys,This is one of those weird issues that you come across, as i could not find anything related to this out in the world wide web searching for many days.Recently came across few account lockouts that have been happening in our domain, and these event alerts are showing computers which are not in our domain. Now there are few alerts where the "Caller Computer Name" is empty, but the majority shows up with incorrect computer names. Any idea why the caller name is not in our domain? was thinking this could be an attack from the outside but looking at the firewall its highly unlikely. I have

:)

 

Domain account getting locked - blank Computer name field in event 4740

Dear Support and Community,

My colleague's domain account keeps getting locked. I followed steps from the below article on how to use Account Lockout Status tool to find what had been causing the lockout:

How to use account lockout status in Active Directory

I found a few corresponding events 4740 on the domain controller Event Viewer, however all of them have the Caller Computer field blank.

I checked events also from other users and all the others had the computer name field populated with their hostnames.

My questions are: what does it mean when this field is blank? What may be causing this event? How to proceed further with identifying the source of the problem if we don't have the computer name?

Thank you in advance!

 

UnattendedJoin error: failed to find the domain data (0x6e)

Thanks for the suggestion! I don't want to add a domain account, as this is a generic unattended install that will be used for all company machines. Do you think it's possible that the computer would join the domain if, instead of using UnattendedJoin in specialize, I used your steps but left out the specific account?

The other thing I was thinking was to use a generic account to allow the domain join during the specialize step. I added a machine password in the UnattendedJoin component, and instead of getting the error listed above, I got an authentication error, which makes me think I could probably do a secure join instead of the unsecure join.

Thoughts?

 

Domain accounts being locked

I have two domain users whose accounts are being locked every 15-30 minutes.

When I check in the domain controller event viewer, it has event ID # 4740.

On the desktop in Windows System event viewer, it has event ID # 40960 - The Security System detected an authentication error for the server cifs/maindc01.FNBSAL.com. The failure code from authentication protocol Kerberos was "The user account has been automatically
locked because too many invalid logon attempts or password change attempts have been requested.

(0xc0000234)".

The user didn't enter an incorrect password and isn't logging on anywhere else.

We use Group Policy to assign drive mappings, so I'm not sure if that was causing anything, so I ran gpupdate /force on her computer and it came back with an error saying Group Policy couldn't be updated due to GPO network drive mappings. I can attach the
error if needed.

Any help with this would be appreciated.

Thanks.