Hello All, we have some users at work are getting locked from computer name called WORKSTATION and we do not have this name of a device.
I have checked even log 4740 and ALTOOL and I am not finding the cause of it.
Any advice on that ?
-
Account are getting locked with Generic computer name WORKSTATION
-
Any ideas ?
-
This seems to be due to an account lockout due to bad password attempts. Here is documentation from Microsoft, read through it and see if it helps: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4740
Best Regards,
Wes BryanKnowledge is a road to be traveled upon, not a destination to be reached~~
-
I hope all is well. This can be caused by several different combinations of variables, but, I have found in the past that it is likely to be happening as a result of the "WORKSTATION" being a personal device connection from a Microsoft Exchange Connection for the user that was getting locked out.
Have you checked to see if that might be a possibility?
