Users occasionally get locked out of our network. When we unlock their accounts, they seem to get locked out again almost immediately. What causes the lockouts?
Repeated lockouts are a common annoyance for Windows administrators, and there is no single reason for them. Because of how authentication and logons work in the multiworkstation, multiserver, multi-application, and multidomain controller (DC) architecture of a typical Windows network, many processes can end up with an outdated set of credentials for a given user and, because of repeated connection attempts, cause repeated lockouts for the user. Of course, another, darker reason for an account lockout might be that the account is under attack.
Microsoft has addressed this common problem with a set of tools and white paper that help you diagnose the problem and distinguish between malicious attacks and the more common cause of outdated credentials somewhere on your network. You can find the Account Lockout and Management Tools at http://www.microsoft.com/downloads/details.aspx?familyid=7af2e69c-91f3-4e63-8629b999 adde0b9e&displaylang=en and the Account Passwords and Policies white paper at http://www.microsoft.com/technet/prodtechnol/windows server2003/technologies/security/bpactlck.mspx.