
GarethB.82994 (Customer) asked a question.
Afternoon All,
Looking for some help with this one - The following is appearing in our Okta logs:-
Authenticate user with AD agent
failure: Login Failed
However 2 mins later I see another log entry showing successful login by the AD Agent, we have not unlocked / changed passwords or carried out any other changes on the account. - The Account in question is one of our service accounts which no one uses and is there only to allow our AD Agents to sync with Okta

Hello @GarethB.82994 (Customer)
I hope you are having a great day
Most of those are events part of the AD agent, this occurs because the user is tied to the API token generated by AD agent installation and the events are tied to other users failing to login. I would confirm with them how they’re resetting their passwords. If they’re resetting using the Okta SSPR tool, resetting their password via AD directly, or if they’re using a Self Service tool.
In addition, if you encounter a problem you can also open a support case with our team.
Have a great day ahead
Regards
Henry Esquivel
Okta Inc