Hi Guys,
I'm facing a strange issue, one of my server (windows server 2008 std R2) is hitting the active directory with a domain account and due to that domain user account is getting locked out very frequently, say in a minute its gets locked out (we've policy to lock out the account after 5 wrong pw try). I got this info from event security log number 4740 on the DC, it simple shows account that was locket out and the caller computer is that server. The server has SQL server 2008 installed, I already checked all the services and make sure if any SQL instance is using that account to authenticate but that user account is not configured anywhere. Just to make sure I shutdown the server for 15 minutes and user account didn't locked out for 15 minutes, I have downloaded a 'lockoutstatus' tool from Microsoft to check the lock out status of the account. I already deleted the user profile from 'My computer properties - advance tab as earlier user was using this account to login on the server but its been months we given another account to him and since then he stopped using this account on the server. I tried to reset the PW and disabled the account for couple of hours to see if server stop trying to hit the AD but nothing worked. My AD is running on the windows server 2008 std R2.
Please help what could be the solution for this issue? How do I identify who is using that account on the server?