one user account always locked out some times, it's around 2-3 times one week.
we open the log, and find it's locked in the exchange server. so I checked the mobile device, it seems ok.
I use the altools to analyze the log on the exchange server, it shows as below:
you may find the logon account isn't the domain account, it's the account name without the domain name (null)\yuwang
I confused why it's the Interactive logon. Please help us on it, how can I solve thi issue or which tool/command can I use for a further analysis? thanks.
I also notice there is guest & administrator which have the same issue. plus, the RCA075 is the exchange server
| 2015/11/17 | 10:36:01 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/17 | 10:36:08 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/17 | 10:36:19 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/17 | 10:36:31 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/17 | 10:36:42 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/17 | 10:36:49 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/17 | 11:37:18 | Interactive logon | (null)\administrator | RCA075 | 0xC000006A |
| 2015/11/17 | 11:52:38 | Interactive logon | (null)\administrator | RCA075 | 0xC000006A |
| 2015/11/18 | 7:31:23 | Interactive logon | (null)\a-ymbi | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:25 | Interactive logon | (null)\yuwang | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:30 | Interactive logon | (null)\yuwang | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:35 | Interactive logon | (null)\yuwang | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:40 | Interactive logon | (null)\yuwang | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:45 | Interactive logon | (null)\yuwang | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:51 | Interactive logon | (null)\yuwang | RCA075 | 0xC000006A |
| 2015/11/18 | 10:15:56 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:01 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:06 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:11 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:16 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:22 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:27 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:32 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 10:16:37 | Interactive logon | (null)\yuwang | RCA075 | 0xC0000234 |
| 2015/11/18 | 16:45:44 | Interactive logon | (null)\guest | RCA075 | 0xC0000234 |
| 2015/11/19 | 3:20:24 | Interactive logon | (null)\administrator | RCA075 | 0xC000006A |
| 2015/11/19 | 3:20:29 | Interactive logon | (null)\administrator | RCA075 | 0xC000006A |
| 2015/11/19 | 3:20:34 | Interactive logon | (null)\administrator | RCA075 | 0xC000006A |
| 2015/11/19 | 3:20:40 | Interactive logon | (null)\administrator | RCA075 | 0xC000006A |
| 2015/11/19 | 7:31:17 | Interactive logon | (null)\a-ymbi | RCA075 | 0xC000006A |