Pretty strange scenario, but maybe it's only strange to me.
I have a Windows 2008 server that is the DC and AD. The domain is "thiscompany.com".
Up until last week, we were hosting our own exchange. On friday, I migrated all of our email to an offsite host. We recreated all accounts on the new host, just transferred the necessaries (emails, calendars, contacts). No funny business, just wanted to get it out of my hair. Obviously, then I just deleted all outlook profiles on the machines and re-ran autodiscover after moving the mx records, etc. The whole shebang. The email works fine.
Here's where it's gets hinky. Ever since then, each user has been logging almost exactly 1 bad password attempt every minute, even while they're already logged in (it's hard to tell, but I think it might be only when they're logged in). Since our login threshold was 10, they were getting locked out of their profiles every time they logged off.
I've checked the event logs on the individual machines and there is no funny business that I can find, although the server does log events for the bad password attempts (I didn't find these manually, I used AD Audit Plus by ManageEngine to monitor them as they come in. The bad logins are definitely coming from their computers and not a cellphone that had the old login or something.
Any ideas on what might be causing this?