Getting Data In

LDAP Service Account Lockout

New Member

We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets randomly locked out. In our environment we have one heavy forwarder, one indexer, one search head, one deployment server, and around 7 Universal Forwarders. Any clues as to why this account gets locked out? Sometimes it happens a couple of times a day, sometimes it goes over a week before it locks out.

Tags (1)
0 Karma

New Member

We are having the same issue, our LDAP service account locks out once a week, authenticating with our DC from our search heads through the lsass.exe process. Have tried figuring out what could cause this and am still working on it.

0 Karma

Path Finder

The question is too generic to answer directly, because any number of things could cause this.

However, you should be able to see the lockout events in the event logs from the AD controller(s). Those will tell you where (ip address/hostname) any bad logins are coming from.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...