Troubleshooting the most common Active Directory account issues | Real World IT Tickets

Summary

In this episode of 'Ticket Thursdays,' the focus is on troubleshooting common account issues in Active Directory. The video addresses frequent problems such as account lockouts due to forgotten passwords, disabled accounts, expired accounts, and access issues to resources. It provides step-by-step solutions, including unlocking accounts, resetting passwords, enabling accounts, extending account validity, and resolving permission issues. Additionally, it covers how to reconnect a computer to the domain after it has been disconnected for an extended period, ensuring viewers can resolve these issues effectively.

Takeaways

• 😀 The video is part of a series called 'Ticket Thursdays', focusing on troubleshooting common account issues in Active Directory.
• 🔐 The most common issue discussed is user account lockouts, often due to forgotten or incorrect passwords entered multiple times.
• 🔑 To resolve a locked account, an administrator can unlock it directly or reset the password if the user cannot remember it.
• 💡 If a user is repeatedly locked out, it could be due to old passwords being cached on computers or applications, requiring a review of the user's login history and a restart of the problematic computer.
• 🕵️‍♂️ The Event Viewer tool is used to diagnose the source of repeated lockouts by filtering logs based on Event ID 4740.
• 🚫 Another issue is when an account is disabled, which can be resolved by enabling the account through Active Directory.
• ⏰ Accounts may also be set to expire, which can be extended or set to 'never' in Active Directory, depending on the user's employment status.
• 🚫 Users may encounter 'access denied' errors due to insufficient permissions, which can be remedied by adding them to appropriate groups or adjusting folder permissions.
• 💻 For computer accounts that have been disconnected from the network, the solution involves rejoining the computer to the domain after ensuring there are no conflicts with existing computer names.
• 🖥️ If a computer has been out of the network for a long time, it might need to be rejoined to the domain, which requires careful handling to avoid name conflicts and ensure a successful reconnection.

Q & A

What is the main focus of the seventh episode of 'Ticket Thursdays'?

The main focus of the seventh episode is troubleshooting common account issues in Active Directory.

Why might a user receive an account lockout message in Active Directory?

A user might receive an account lockout message if they enter the wrong password too many times, either due to forgetting their new password after a recent change or simply typing it incorrectly.

How can an administrator unlock a user's account in Active Directory?

An administrator can unlock a user's account by going to Active Directory Users and Computers, searching for the user, opening their account properties, and checking the 'Unlock Account' option.

What should an administrator do if a user's account keeps getting locked out repeatedly?

If a user's account keeps getting locked out, the administrator should use tools like Event Viewer to identify which computer is causing the lockouts and ensure that any cached old passwords or background processes using the old password are addressed.

How can an administrator enable a disabled user account in Active Directory?

An administrator can enable a disabled user account by locating the user in Active Directory Users and Computers, right-clicking on the user, and selecting 'Enable Account'.

What does it mean when a user's account is said to have expired in Active Directory?

When a user's account is said to have expired, it means that the account has a set expiration date and the user can no longer log in because the date has passed. This often happens with temporary workers like contractors or interns.

How can an administrator extend the expiration date of a user's account in Active Directory?

An administrator can extend the expiration date of a user's account by going to the account properties in Active Directory Users and Computers, selecting the 'Account' tab, and changing the 'Account expires' option to a future date or setting it to 'Never'.

Why might a user receive an 'Access Denied' message when trying to access shared resources?

A user might receive an 'Access Denied' message if they lack the necessary permissions to perform actions on shared resources. This can happen if permissions were not properly set during the user's onboarding process.

How can an administrator resolve the issue of a user receiving 'Access Denied' when accessing shared resources?

An administrator can resolve 'Access Denied' issues by checking the user's group memberships in Active Directory and ensuring they are part of the appropriate groups with the necessary permissions. They can also adjust the NTFS and sharing permissions on the specific shared folder.

What does the error message 'The security database on the server does not have a computer account for this workstation trust relationship' indicate?

This error message indicates that the computer has been disconnected from the network for an extended period and is no longer recognized by the domain. It needs to be reconnected to the domain.

How can an administrator reconnect a computer to the domain if it has been disconnected for a long time?

An administrator can reconnect a computer to the domain by logging in with a local admin account, changing the computer's settings to join a workgroup, and then rejoining it to the domain with the correct domain credentials. It's important to ensure that the computer name does not conflict with existing names in the domain.