One of the user accounts on a Windows 2003 server is frequently locked. Each time the "Account is locked" (roughly translated) checkbox is enabled in the Account Properties -> Account tab. The event viewer only mentions that the account is locked, or that I've unlocked it.
However, I don't see any message why the account gets locked in the first place.
Are there know reasons why an account gets locked, or is there a way to find out why this happens?
Best Answer
It sounds like someone or a process is trying to login to the account and keeps locking it. You need to enable auditing of failed login attempts.
If your machine is on a domain you can do the following: Audit Active Directory Objects in Windows Server 2003
If your machine is not on a domain, try the following: Logging Failed Log-in Attempts
This should give you an idea of the machine/process that is trying to login as that user.