I've recently installed Windows 7 (Professional) on some machines, and am finding that the accounts I set up on them are getting locked out frequently, independently of any failed password attempts from the users.
Possibly relevant details:
-These are stand-alone machines that have never been connected to a domain, so it can't be an AD issue
-They've never been connected to a network at all so it can't be a remote session problem
-The machines are dual-boot but the windows 7 partition is never mounted/accessed from any other OS
-Password policy has been modified from the default (account lockout after n tries, enforce complexity, etc), and the passwords set meet the complexity requirements
I've looked in the event logs and while I can see the lockouts occurring (event ID 4740, in the security log as 'audit success'), there's nothing else around that time in any of the event log categories that looks suspicious - no failed password attempts are shown at all (which surprises me, do I need to do anything extra to turn this on?).
I've set very little up in terms of software on these so far, so I wouldn't expect it to be a service attempting to run with a cached incorrect password, but I'm at a loss as to what else it could be.
Any ideas on how to track down what's causing this?
Possibly relevant details:
-These are stand-alone machines that have never been connected to a domain, so it can't be an AD issue
-They've never been connected to a network at all so it can't be a remote session problem
-The machines are dual-boot but the windows 7 partition is never mounted/accessed from any other OS
-Password policy has been modified from the default (account lockout after n tries, enforce complexity, etc), and the passwords set meet the complexity requirements
I've looked in the event logs and while I can see the lockouts occurring (event ID 4740, in the security log as 'audit success'), there's nothing else around that time in any of the event log categories that looks suspicious - no failed password attempts are shown at all (which surprises me, do I need to do anything extra to turn this on?).
I've set very little up in terms of software on these so far, so I wouldn't expect it to be a service attempting to run with a cached incorrect password, but I'm at a loss as to what else it could be.
Any ideas on how to track down what's causing this?
