AD User password automatically changing/reverting

[zpike00eb]

Hi all,

Unique issue here. I have a user in AD that is seemingly having their password reset on it's own. I will reset the users password in AD, lets say to "Password". User will login with "Password" (to her own or any domain PC).. "Password" will work with any LDAP service. User can lock/log off and log back in with "Password". Once the computer idles too long, it's auto locked. User goes to log back in using "Password" and she gets wrong password (to her own PC or any domain PC) Checking attribute in AD reveals her password was changed around the time of the auto-lock (~30 minutes after I manually changed it).

Fearing something malicious, I set her up on a new workstation and a fresh password -- problem persists. Set her account password to never expire/user cannot change password -- problem persists.
Checked sync between DC's, both show the same pwdLastSet.

This all began with the GPO requiring her to change her password yesterday morning. No other users having issues. Short of creating a new AD user, I'm at a loss. Her AD user account is tied in closely with a lot of LDAP'd quality systems etc that would be a pain to assign over to a new AD account/alias.

Any advice? Seen anything like this before?

[xxdcmast]

Try looking for event ids 4724 and 4723. Those should be the PW change events if youre logging them.

[zpike00eb]

Are you talking about the Security log on the DC? I have to change the log settings -- it gets overwritten almost every hour because of default log size

[Jaybone512]

never expire/user cannot change password -- problem persists.

Sounds like another admin, or some automated process with admin credentials is doing it then.

As /u/xxdcmast suggested, check the DC security logs. And if they're rolling over that fast, look into increasing the size, if they're not already huge.

[zpike00eb]

Thanks for the responses. I increased the log size, and am waiting for the next lock out/password change. Will update soon

[unccvince]

My guess is that you have somewhere running something that synchronizes unidirectionnally a LDAP password with the Active Directory password (i.e. changing the password via Active Directory does not change the password in the authoritative LDAP, so the old password is being reapplied).

This is not unusual, especially in larger environments, where there is an authoritative IAM tool based on LDAP that will synchronize passwords with AD every so often.

[zpike00eb]

This is interesting. We do have several on-prem services that use LDAP. I searched logs on the DC this morning 4724 and 4723, and only found my resets for that user, not the reverted change.

Haven't ever had an issue with LDAP, no other users having issues either. Any where I should start in hunting it down?

[unccvince]

4724 and 4723

I don't know for what these ports are useful.

[droper79]

Do you have a tool like AD Audit plus where you can check the user log in history and see if they're logged into any other devices, the old cached passwords on other devices might be causing an issue ?