I have been getting locked out of my admin account every 1 hour and 1 second since changing my password. Before changing my password I enabled FIPS on the domain controllers. My account will stop locking out if I go to account settings and disable Kerberos
Pre-Authentication. The funny thing is setting my password back to what it was did not fix the problem. If I turn on Kerberos Pre-Auth it doesn't lock, turn it back on and it locks every hour.
I did all the normal stuff. Checked processes, scheduled tasks, mapped drives, logons from other machines, etc. I don't have any creds stored in credential manager and I even wiped out my local profile.
I created a scheduled task that gets triggered off a 4740 lockout event. Why? So I can see if someone is brute forcing our domain. The scheduled task has my domain admin account as the author but is setup to run as a service account. I can see in the security events that it locks my account then right after the service account runs this task. I'm not logged on anywhere else in the domain and the lockouts are coming from the domain controller.
I created a second domain admin account, changed the password, and this one is not getting locked out.
In the registry the only two credentials that are stored are for service accounts. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom
Here is the event, slightly modified by me. It doesn't tell me the process that is locking me out.
A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: DOMAINCONTROLLER$
Account Domain:
DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: DOMAIN\joe.alves.adm
Account Name: Joe.Alves.Adm
Additional Information:
Caller Computer Name:
DOMAINCONTROLLER
Here is one of the Kerberos Pre-Auth errors before the lockout.
Kerberos pre-authentication failed.
Account Information:
Security ID: Domain\Joe.Alves.Adm
Account Name: Joe.Alves.Adm
Service Information:
Service Name: krbtgt/mwglan01
Network Information:
Client Address:::1
Client Port: 0
Additional Information:
Ticket Options:0x40810010
Failure Code: 0x18
Pre-Authentication Type:2
Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Certificate information is only provided if a certificate was used for pre-authentication.
Pre-authentication types, ticket options and failure codes are defined in RFC 4120.
If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
Here is an example of how my scheduled tasks are setup. I am the author of these but my account is not used to run them.
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2019-02-24T12:26:17.8640552</Date>
<Author>Domain\joe.alves.adm</Author>
<Description>E-mails notification when account is locked out.</Description>
</RegistrationInfo>
<Triggers>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4740]]</Select></Query></QueryList></Subscription>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<RunLevel>HighestAvailable</RunLevel>
<UserId>Domain\SVCTask SchedulerDC</UserId>
<LogonType>Password</LogonType>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>P3D</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>powershell.exe</Command>
<Arguments>-command C:\Scripts\4740_Lockouts.ps1</Arguments>
</Exec>
</Actions>
</Task>
I did all the normal stuff. Checked processes, scheduled tasks, mapped drives, logons from other machines, etc. I don't have any creds stored in credential manager and I even wiped out my local profile.
I created a scheduled task that gets triggered off a 4740 lockout event. Why? So I can see if someone is brute forcing our domain. The scheduled task has my domain admin account as the author but is setup to run as a service account. I can see in the security events that it locks my account then right after the service account runs this task. I'm not logged on anywhere else in the domain and the lockouts are coming from the domain controller.
I created a second domain admin account, changed the password, and this one is not getting locked out.
In the registry the only two credentials that are stored are for service accounts. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CredWom
Here is the event, slightly modified by me. It doesn't tell me the process that is locking me out.
A user account was locked out.
Subject:
Security ID: SYSTEM
Account Name: DOMAINCONTROLLER$
Account Domain:
DOMAIN
Logon ID: 0x3E7
Account That Was Locked Out:
Security ID: DOMAIN\joe.alves.adm
Account Name: Joe.Alves.Adm
Additional Information:
Caller Computer Name:
DOMAINCONTROLLER
Here is one of the Kerberos Pre-Auth errors before the lockout.
Kerberos pre-authentication failed.
Account Information:
Security ID: Domain\Joe.Alves.Adm
Account Name: Joe.Alves.Adm
Service Information:
Service Name: krbtgt/mwglan01
Network Information:
Client Address:::1
Client Port: 0
Additional Information:
Ticket Options:0x40810010
Failure Code: 0x18
Pre-Authentication Type:2
Certificate Information:
Certificate Issuer Name:
Certificate Serial Number:
Certificate Thumbprint:
Certificate information is only provided if a certificate was used for pre-authentication.
Pre-authentication types, ticket options and failure codes are defined in RFC 4120.
If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
Here is an example of how my scheduled tasks are setup. I am the author of these but my account is not used to run them.
<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
<RegistrationInfo>
<Date>2019-02-24T12:26:17.8640552</Date>
<Author>Domain\joe.alves.adm</Author>
<Description>E-mails notification when account is locked out.</Description>
</RegistrationInfo>
<Triggers>
<EventTrigger>
<Enabled>true</Enabled>
<Subscription><QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4740]]</Select></Query></QueryList></Subscription>
</EventTrigger>
</Triggers>
<Principals>
<Principal id="Author">
<RunLevel>HighestAvailable</RunLevel>
<UserId>Domain\SVCTask SchedulerDC</UserId>
<LogonType>Password</LogonType>
</Principal>
</Principals>
<Settings>
<MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
<DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
<StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
<AllowHardTerminate>true</AllowHardTerminate>
<StartWhenAvailable>false</StartWhenAvailable>
<RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
<IdleSettings>
<StopOnIdleEnd>true</StopOnIdleEnd>
<RestartOnIdle>false</RestartOnIdle>
</IdleSettings>
<AllowStartOnDemand>true</AllowStartOnDemand>
<Enabled>true</Enabled>
<Hidden>false</Hidden>
<RunOnlyIfIdle>false</RunOnlyIfIdle>
<DisallowStartOnRemoteAppSession>false</DisallowStartOnRemoteAppSession>
<UseUnifiedSchedulingEngine>false</UseUnifiedSchedulingEngine>
<WakeToRun>false</WakeToRun>
<ExecutionTimeLimit>P3D</ExecutionTimeLimit>
<Priority>7</Priority>
</Settings>
<Actions Context="Author">
<Exec>
<Command>powershell.exe</Command>
<Arguments>-command C:\Scripts\4740_Lockouts.ps1</Arguments>
</Exec>
</Actions>
</Task>