a. Issue began last Thursday (office 2003, xp), pc has been since replaced with windows 7/office 2010 (new pc, new pc name)
b. password has been changed multiple times and forced on different DCs, also changed back to the original password.
c. exchange account was removed from iphone, added back on, removed. Iphone was turned off for a day and it still occured.
d. user logged off and it still occurs.
e. used lockoutstatus and eventcombmt:
-its not another pc
-the only DC and lockout events point to a TMG server. The TMG server points to no culprits or errors.
f. bad attempts come in bursts of 4 or 1 at a time, hit 10 then lock the account out.
g. nothing in owa, no forwarding, no malware (new image) and no pcs she logged in to. home pc is offline just in case itunes or something was running it was powered down yesterday. all nearby pcs rebooted just in case.
h. no vaulted/cached creds in windows
i. new office and windows profiles tested
"Their password has been set, mailbox moved, active sync enabled/disabled/enabled, pc reimaged to Windows 7, new profiles and multiple password resets including back to their original password and again to a new password. Exchange was removed from her phone for two days and added back on today without a change (iphone"
example DC errors:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: xyz Source Workstation: Cremovedservername Error Code: 0xc0000234
4776,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Wed Dec 10 13:44:39 2014,No User,The computer attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: xyz Source Workstation: Cremovedservername Error Code: 0xc000006a