Getting Data In

LDAP Service Account Lockout

johannterc
New Member

We use LDAP authentication to log into Splunk. The AD service account we use for Splunk LDAP authentication gets randomly locked out. In our environment we have one heavy forwarder, one indexer, one search head, one deployment server, and around 7 Universal Forwarders. Any clues as to why this account gets locked out? Sometimes it happens a couple of times a day, sometimes it goes over a week before it locks out.

Tags (1)
0 Karma

travlin
New Member

We are having the same issue, our LDAP service account locks out once a week, authenticating with our DC from our search heads through the lsass.exe process. Have tried figuring out what could cause this and am still working on it.

0 Karma

sjalexander
Path Finder

The question is too generic to answer directly, because any number of things could cause this.

However, you should be able to see the lockout events in the event logs from the AD controller(s). Those will tell you where (ip address/hostname) any bad logins are coming from.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...