Troubleshoot Possible Root Causes for Account Lockouts

Possible Root Causes for Account Lockouts
? Persistent drive mappings with expired credentials
Active sync devices (cell phone,etc..)
? Mobile devices using domain services like Exchange mailbox
? Service Accounts using cached passwords
? Scheduled tasks with expired credentials
? Clear the stored credentials - cmd "RunDll32.exe keymgr.dll,KRShowKeyMgr"
? Misconfigured domain policy settings issues
? Disconnected Terminal Server sessions
? Programs that may pass user credentials to a centralized network program or middle-tier         application   layer

---
Client side troubleshooting
Mobile device / BYOD
Server side checklist

---

Client side

Perform the below steps on client side (local desktop / laptop)

• Check If a Local User Account is present with the same Name as AD account. If same ID is available, rename local ID to some other ID.
• Clear Temporary Files
• Delete Cookies / Temp Files / History / Saved passwords / Forms from all the browsers.
• Start — > Run –> Temp –> Delete all temp files.
• Start –> Run –> Prefetch –> Delete all Prefetch files.
• Remove Mapped Drives from the computer.  My Computer –> Right click on Shared drive –> click on Disconnect
• If Adobe Reader is installed, in the back end it will be trying to check for latest update. Delete the Adobe Updater file from below path. Delete the AdobeUpdater.dll file in the folder C:\Program Files\Adobe\Reader version \Reader
• Remove stored passwords from Control Panel.
• Start –> Run –> Type Control UserPasswords2 , click on Advanced managed passwords and delete all the passwords.
• Remote unwanted applications from StartUp (Run –> msconfig –> startup –> Uncheck unwanted software)
• Scan the entire HDD and update the Antivirus agent.
• Check the third party software installed on client side. If it’s not required, uninstall.
• Open the Task Scheduler (Run --> Tasks) and delete unwanted tasks. Most of the time, Automatic Backup / Google Update / Apple Updates will be installed by default. Remove all.
• Uninstall Auto Update software’s in Control Panel. (You can update this software manually.)
• If user’s account acts as a service account, update the latest password in service.
• User’s account used as an IIS Application Pool identity.

Mobile Devices

Perform the below steps on mobile devices / smartphones (BYOD)

If user recently changed the password and forgot to update in mobile devices, that caused the account lockout for user ID.

Does user involved have a smartphone or some kind of mobile device using AD credentials for connecting (like exchange)? If it fails to connect three times (depending on your GPOs), it locks their account. Have a look on all their stuff using their user account automatically, especially their mobile (90% of the time).

• Go to account settings in a mobile device and update the latest password.
• Reboot the device if required.
• Is issue persists, delete and reconfigure the device,
• If you found the account is getting locked from a mobile device, and unable to fix the by performing above steps, take the necessary backup and wipe the device completely and reconfigure the device.

Ref: https://social.technet.microsoft.com/wiki/contents/articles/23497.active-directory-troubleshooting-frequent-account-lockout.aspx