I have a user that gets locked out of their AD account almost daily and sometimes multiple times a day.
The account even gets locked out when they are not working. They utilize 3 different computers two of which generate the lockouts - so I know at least the devices. it seems when the user is using RDP they tend to get locked out almost immediately afterwards - but not always.
I do not have control over the DC or the AD, I have limited access to the AD and limited permissions - we are a large organization and members of my group simply say wipe them and re-image done.
I would like to know what is causing this and try to troubleshoot it to resolve it. There is specialized software loaded on these machines and it is a nightmare going through the process of getting the licenses installed and it is a real pain (plus they are older versions that are required for us to have) - so I would like to avoid that scenario.
So how can I track this down to the application ? I have searched event logs and it seems to be related to terminal services.
I have checked scheduled tasks and can not find anything. I have looked at running services and applications at startup on both machines and do not seem to find anything.