Hello,
I have a strange issue. I have a customer who has CUCM / UCCX / Presence and Unity Connection installation on a BE6k. A couple times a week one of the users is reporting that her account is locked out. When we take a look at the audit logs on the AD servers all the failed attempts are coming from the CUCM subscriber (usually about 10 failed attempts in a 3 minute time frame). I've verified this in the CUCM tomcat security traces, however I can't find any logs that shows me the device that the attemps are comming from.
This user is a Jabber / UCCX user so it could be one of these applications. The strange part is sometimes she is locked out when her primary machine isn't even on. Obviously it might be another device on the network she has logged into but i'm wondering anyone knows of any traces that may help me. I've looked the regular tomcat logs but didn't find any detail there.
Thanks.
