Windows 10: Mystery Account

Been using Windows 10 since Aug and really like it. My problem is when turning on my laptop when it gets tothe logon screen, there is a mystery account has showed up that has my account name on it that it defaults to and password doesn't work *Sad but I can't logon with it. I have to manually click on my previous account with my user
name and MS email account to logon with my password. I have been in to PC settings 'Accounts' and can't find this
account so I can totally remove it. Any ideas here? Thanks

:)

 

Account Lockout Mystery

Is the user accessing business resources (likely email) via a mobile device? If so, then it is possible they don't have the correct password on the device and as the mail app tries to connect, and fails, over and over, it reaches your domain's login limits
and locks the account.

For ours it is set that after 10 bad login tries after a set period of time the account locks out. This often is tried by someone's mobile mail app when the don't have the correct password on the device.

 

Account Lockout Mystery

We have an account that is continuously locking out. It seems to be coming for one of the domain controllers. I have checked cached credentials and services and there is nothing saved or using the account.
I posted this on the Technet forum but had not had any responses

Log Name: Security

Source: Microsoft-Windows-Security-Auditing

Date: 7/13/2017 8:12:45 AM

Event ID: 4771

Task Category: Kerberos Authentication Service

Level: Information

Keywords: Audit Failure

User: N/A

Computer: **************

Description:

Kerberos pre-authentication failed.

Account Information:

Security ID:
netBIOS Domain\the account in questions

Account Name:
the account in question

Service Information:

Service Name:
krbtgt/netbiosdomainname

Network Information:

Client Address:
::1

Client Port:
0

Additional Information:

Ticket Options:
0x40810010

Failure Code:
0x18

Pre-Authentication Type:
2

Certificate Information:

Certificate Issuer Name:

Certificate Serial Number:

Certificate Thumbprint:

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />

<EventID>4771</EventID>

<Version>0</Version>

<Level>0</Level>

<Task>14339</Task>

<Opcode>0</Opcode>

<Keywords>0x8010000000000000</Keywords>

<TimeCreated SystemTime="2017-07-13T15:12:45.585663300Z" />

<EventRecordID>80647416</EventRecordID>

<Correlation />

<Execution ProcessID="632" ThreadID="688" />

<Channel>Security</Channel>

<Computer>**************</Computer>

<Security />

</System>

<EventData>

<Data Name="TargetUserName">account in question</Data>

<Data Name="TargetSid">S-1-5-21-518783779-895579688-313593124-3430</Data>

<Data Name="ServiceName">krbtgt/netbiosdomainname</Data>

<Data Name="TicketOptions">0x40810010</Data>

<Data Name="Status">0x18</Data>

<Data Name="PreAuthType">2</Data>

<Data Name="IpAddress">::1</Data>

<Data Name="IpPort">0</Data>

<Data Name="CertIssuerName">

</Data>

<Data Name="CertSerialNumber">

</Data>

<Data Name="CertThumbprint">

</Data>

</EventData>

</Event>

 

Try running netplwiz and toggle the "Users must enter a password..." box on and off a few times (pressing apply in between) as described in steps 4 and 5 in option 1 here Sign in User Account Automatically at Windows 10 Startup - Windows 10 Forums

 

Thanks lx07 that done it. The mystery account mysteriously disappeared as it mysteriously showed up *Smile