LDAP Auth causing AD Account Lock-Out

[Darren_Aitchison]

Hi, I have a customer running v4.2 patch2 on a pair of 620B' s. They have a webfiltering identity based policy which uses LDAP authentication. The requirement is for users to only need to explicitly authenticate once each day so the Authentication Timeout has been set to 480 minutes. This seems to be working as expected and users are only asked to authenticate once, however we have just noticed an issue. Users are reporting that their AD accounts are being locked out at least once per day; an example of the DC events relating to this are shown below: Event Type: Failure Audit Event Source: Microsoft-Windows-Security-Auditing Event Category: (14336) Event ID: 4776 Date: 04/11/2010 Time: 13:42:59 User: N/A Computer: xxxxxxxx01S.xxxx.xx.xxxxxx.xxxx.xx Description: The domain controller attempted to validate the credentials for an account. Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Logon Account: BLOGGSJ Source Workstation: xxxxxxxx01S Error Code: 0xc000006a Event Type: Failure Audit Event Source: Microsoft-Windows-Security-Auditing Event Category: (12544) Event ID: 4625 Date: 04/11/2010 Time: 13:42:59 User: N/A Computer: xxxxxxxx01S.xxxx.xx.xxxxxx.xxxx.xx Description: An account failed to log on. Subject: Security ID: S-1-5-18 Account Name: xxxxxxxx01S$ Account Domain: xxxx Logon ID: 0x3e7 Logon Type: 3 Account For Which Logon Failed: Security ID: S-1-0-0 Account Name: BLOGGSJ Account Domain: xxxx Failure Information: Failure Reason: %%2313 Status: 0xc000006d Sub Status: 0xc000006a Process Information: Caller Process ID: 0x260 Caller Process Name: C:\Windows\System32\lsass.exe Network Information: Workstation Name: xxxxxxxx01S Source Network Address: xx.xx.1.51 Source Port: 17635 Detailed Authentication Information: Logon Process: Advapi Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 Transited Services: - Package Name (NTLM only): - Key Length: 0 The xx.xx.1.51 address is the IP of the Fortigate whislt xxxxxxxx01S is the name of the workstation. I have checked out the error codes and they translate to correct username wrong password. I guess that AD is validating the user credentials on a periodic basis but Fortigate is not replying with the correct information. Does anyone have any ideas what may be going on and how to resolve it? Many thanks. Darren

[jtrin]

Hi - I'm running into a similar issue and I'm leaning towards LDAP on our FortiGate. Did you ever resolve the issue in your domain?

[xsilver_FTNT]

Hi jtrin,

could you elaborate on your case a bit more ?

Because what you might missed is that post you commented on is from 2010 and FortiOS 4.2.2. Which is pretty old.

[jtrin]

Hi, we're on 7.2.8, and trying to rule out possibilities of the cause. Random accounts are getting locked out daily, even disabled accounts. Maybe about 5 accounts per day. The above post had similar details to what we're going through now. We have regular LDAP connection with domain auth setup in FortiGate and I can see something is triggering the credential validation. Source ip is the FortiGate, but can't tell if it's a false positive.

[nathan_h]

Hi jtrin,

You can check on the User Event logs if it is matching the timestamp. You may also find there the source IP that is causing the lockout.

[jtrin]

I believe I've resolved the issue this morning. Correct, the source IP is the FortiGate, that's what lead me to LDAP. An MSP used a domain admin account to authenticate LDAP. I created a new domain account and added it to the Account Operator domain group. I changed the login for LDAP in FortiGate to that new domain account. The issue went await. I haven't had a lockout or failed attempt from the source ip since the change and that's unheard of for us. I also updated the distinguished name in LDAP settings and narrowed it down to a specified OU instead of the entire directory like the MSP had it. These MSP firms aren't as good as they portray themselves.

[jtrin]

Is there a way we can reduce the frequency FortiGate queries LDAP? Right now, the event logs on the domain controller is showing FortiGate is constantly querying LDAP.