LDAP Service Account Lockout

[johannterc]

We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets randomly locked out. In our environment we have one heavy forwarder, one indexer, one search head, one deployment server, and around 7 Universal Forwarders. Any clues as to why this account gets locked out? Sometimes it happens a couple of times a day, sometimes it goes over a week before it locks out.

[travlin]

We are having the same issue, our LDAP service account locks out once a week, authenticating with our DC from our search heads through the lsass.exe process. Have tried figuring out what could cause this and am still working on it.

[sjalexander]

The question is too generic to answer directly, because any number of things could cause this.

However, you should be able to see the lockout events in the event logs from the AD controller(s). Those will tell you where (ip address/hostname) any bad logins are coming from.