FinnP.13041 (Customer) asked a question.
I have been attempting to troubleshoot a user whose account gets repetitively locked out, multiple times a day.
I have audited Microsoft event logs for the corresponding Domain Controllers
Audited Okta authentication logs looking for auth failures
Audited Microsoft Entra logs to look for auth failures there
Utilized free account lockout examination software (Netwrix)
None of them have been able to successfully diagnose what could be causing the issue, just that it is happening. I have exhausted all resources I can think of, and am really at the end of my ideas, so now I am reaching out to the help center here in hopes that someone can potentially help me figure out why this user continues to get locked out over and over again.
Hi @FinnP.13041 (Customer) , Thank you for reaching out to the Okta Community!
If this is explicitly in the context of the user getting the status "locked out", I've had this experience with users that recently changed their password for Okta but never updated their desktop apps/devices to leverage the new password (for example 3rd party mail app services), so they were automatically attempting authentication with the cached credentials.
If it's in the context of users just not being able to log in with no error or generic error, I've seen situations where Okta ThreatInsight triggers a false positive in conjunction with maybe VPN use, so the Okta system logs will not display any activity related to the user specifically, because that event triggers before authentication. You'll need to review ThreatInsight logs and correlate the event time-stamps and involved IPs with the user's authentication attempts.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
This month's AMA topic: Okta Device Access. Ask away today.