Getting Data In

LDAP Service Account Lockout

New Member

We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets randomly locked out. In our environment we have one heavy forwarder, one indexer, one search head, one deployment server, and around 7 Universal Forwarders. Any clues as to why this account gets locked out? Sometimes it happens a couple of times a day, sometimes it goes over a week before it locks out.

Tags (1)
0 Karma

New Member

We are having the same issue, our LDAP service account locks out once a week, authenticating with our DC from our search heads through the lsass.exe process. Have tried figuring out what could cause this and am still working on it.

0 Karma

Path Finder

The question is too generic to answer directly, because any number of things could cause this.

However, you should be able to see the lockout events in the event logs from the AD controller(s). Those will tell you where (ip address/hostname) any bad logins are coming from.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...