We are having an issue where a user’s account is constantly being locked. We ran the Login Failure Audit report and see that the system is trying to login them every couple of minutes and then locks the account. Has anyone ever experienced this issue?
This smells like malware.
1 Like
Is that user tied to any scheduled reports/methods where the system is trying to use that account to process that task?
2 Likes
We’ve seen this issue before. If you have any connected services, like ECC, QuickShip, etc…, if the password expires on the service account you use to connect, you will see this behavior. Check your service accounts and see if any are expired or locked.
2 Likes
That’s what I was thinking too. We had a specific user account set-up to tie in DocStar and ran into something similar.
2 Likes
are they using single sign on with their windows account?
I looked but don’t find anything.
No they are not. But thank you!
Same here.
The customer isn’t using DocStar so have to scratch that one off the list!
Thanks all for the replies.
Are they cloud or on prem? If they are on prem, you look at the sessions and see the computer name of the session. Maybe you can see if it’s coming from somewhere else?
1 Like
windows event viewer Security log > check to make sure something else isn’t locking the user out.
No they are not.
At the risk of sounding dumb, is there a way to see if they are on a schedule? I can view the tasks and the task parameters but it does not show me who is getting the reports.
Well, the more I think about it, I doubt this is your issue… but since you asked…
I’m SaaS and it looks like you’re on prem, so, not sure if it may be different for you. But I see our reoccurring tasks in the “System Agent” menu.
You would see a list of schedules like above. Some set to run daily, others could be set up at an “Interval”.
When you look at a particular schedule, you can see who added/assigned a given task to that particular schedule. For example, I set up our “Generate PO Suggestions” to run nightly at 2AM every night… so I see my user there.
The fact that your issue is occurring every couple minutes makes this seem pretty unlikely, unless someone set up a schedule to happen very frequently. And even in this case… I don’t have to be logged in for this process to run, so, this doesn’t seem related to your issue.
Have you tried with the user to reset his/her password and login as that user and see in system monitor what is under scheduled tab ?