Azure AD account locked out, but does not show being locked out in Azure or on-prem AD

Martin, Gregory (Capital) 0

Having an issue with two service accounts where they are giving a message when trying to login to Office to open Excel. The error just says that the account is locked out. I have verified that the account is not locked out at least in our on-prem AD. I was provided a script from Microsoft yesterday to unlock the Azure account, but that command did not work. Microsoft was unable to help me resolve the issue and transferred my ticket over to the account lockout/synchronization team (which has yet to respond back to me). The Azure account itself looks ok, it is enabled.

Thameur-BOURBITA 33,486 Reputation points

2024-11-21T22:16:51.03+00:00

Hi @Martin, Gregory (Capital)

Did you check if this account use MFA to authenticate on Office service ?
Bhasker Donthu 765 Reputation points Microsoft Vendor

2024-11-22T10:16:31.3733333+00:00
Hello @Martin, Gregory (Capital),

Thank you for posting your query on Microsoft Q&A.

Understood that the service account was locked out while trying to log in to the Office app. To provide a better solution, could you please share additional details, such as:

How the lockout police are set up.

Are there any Group police applied for lockout.

Whether the accounts have licenses assigned.

Whether the accounts are linked with MFA.

Additionally, here are some steps you can take to troubleshoot this problem:

Check Azure AD Sign-In Logs: Look at the sign-in logs in Azure AD to see if there are any specific error messages or patterns that might give more insight into why the accounts are being locked out.

Password Synchronization: Ensure that password synchronization between your on-premises AD and Azure AD is working correctly. Sometimes, a mismatch can cause account lockout issues.

Conditional Access Policies: Review any Conditional Access policies that might be affecting these accounts. There could be policies in place that are inadvertently causing the lockouts.

Multi-Factor Authentication (MFA): Verify if MFA is enabled for these accounts and if there are any issues with the MFA setup that might be causing the lockout.

Azure AD Connect Health: Use Azure AD Connect Health to check for any synchronization issues or alerts that might be related to these accounts.

Unlock Account via Azure Portal: Try unlocking the account directly from the Azure portal. Go to Azure AD > Users > Select the user > Reset password. This can sometimes resolve lockout issues.

I hope this information is helpful. Please feel free to reach out if you have any further questions.
Martin, Gregory (Capital) 0 Reputation points

2024-11-22T12:41:49.03+00:00

Hello, I kept my initial question kind of short since I wasn't sure what kind of response I would get back. I have a lot of additional information on this issue, which I will explain below.

We are not using multi-factor authentication for these two accounts we are having issues with, they are using pass-through as the method. These are both service accounts, which are tied to other processes in the company so a "password change" is really not an option for us. These two accounts are working properly with no issues for other processes that they are linked to within our company. It seems to be just an issue when trying to access O365 with these accounts.

We initially thought that it might have something to do with Smart Lockout, which maybe it does, but we turned this setting off "Enable password protection on Windows Server Active Directory".

Here is what shows when we run a sign-in diagnostic,

If I look at any of the "Risky" user information, this account or the other account we are having issues with does not show up in there. The password is not getting locked out on-prem, just appears to be somehow locked in Azure. We already deleted this account from Azure, deleted the account from deleted users, and let the account resync again. That did not resolve our issue. I also checked for any cached credentials on the server I was trying this from and didn't find anything out of the ordinary. I also cleared out the browser cache, but that did not resolve the issue.

The account is licensed with an "Office 365 E5" license.

Here is what the on-prem account looks like in Active Directory,

I did scroll through the list of other options under the "Account options". Nothing else is checked on this account. We thought possibly that we might need to enable the "Kerberos AES 256 bit encryption" option, but I did that and nothing changed. I did play around with the "User cannot change password" setting yesterday by unchecking this box, then trying to change the password in Azure. Our "tenant does not allow write-back" to be able to change passwords in Azure is the message that I got when I tried.

I was able to find some additional event logs, but these logs appeared to take us in circles without really nailing down the issue.

The "Source Workstation" above is an Azure Pass-Through server we have configured.

The following screenshots are all of one event log message, just couldn't copy everything at once.

Here is another event log message we received,

Log Name:      Security

Source:        Microsoft-Windows-Security-Auditing

Date:          11/20/2024 1:00:02 PM

Event ID:      4771

Task Category: Kerberos Authentication Service

Level:         Information

Keywords:      Audit Failure

User:          N/A

Computer:      EADSA12.bcnet.capbluecross.com

Description:

Kerberos pre-authentication failed.

Account Information:

                Security ID:                       BCNET\STEPWISEDEV

                Account Name:                               STEPWISEDEV

Service Information:

                Service Name:                krbtgt/BCNET

Network Information:

                Client Address:                                ::ffff:10.171.0.117

                Client Port:                        53071

Additional Information:

                Ticket Options:                0x40810010

                Failure Code:                    0xE

                Pre-Authentication Type:           0

Certificate Information:

                Certificate Issuer Name:

                Certificate Serial Number:

                Certificate Thumbprint:

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />

    <EventID>4771</EventID>

    <Version>0</Version>

    <Level>0</Level>

    <Task>14339</Task>

    <Opcode>0</Opcode>

    <Keywords>0x8010000000000000</Keywords>

    <TimeCreated SystemTime="2024-11-20T18:00:02.015324300Z" />

    <EventRecordID>3263146094</EventRecordID>

    <Correlation />

    <Execution ProcessID="808" ThreadID="6164" />

    <Channel>Security</Channel>

    <Computer>EADSA12.bcnet.capbluecross.com</Computer>

    <Security />

</System>

<EventData>

    <Data Name="TargetUserName">STEPWISEDEV</Data>

    <Data Name="TargetSid">S-1-5-21-2139973840-759442693-941767090-45098</Data>

    <Data Name="ServiceName">krbtgt/BCNET</Data>

    <Data Name="TicketOptions">0x40810010</Data>

    <Data Name="Status">0xe</Data>

    <Data Name="PreAuthType">0</Data>

    <Data Name="IpAddress">::ffff:10.171.0.117</Data>

    <Data Name="IpPort">53071</Data>

    <Data Name="CertIssuerName">

    </Data>

    <Data Name="CertSerialNumber">

    </Data>

    <Data Name="CertThumbprint">

    </Data>

</EventData>

</Event>

I believe that I answered most of your questions from above, but let me know if you need anything else from me.

1 answer

Martin, Gregory (Capital) 0 Reputation points

2024-11-22T12:29:31.02+00:00

deleted from answer and added to comment section
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure AD account locked out, but does not show being locked out in Azure or on-prem AD

1 answer

Your answer