AD Sync Locking Accounts out?

[devils_advocate]

Hi

We have a test system where I am testing the AD import and sync of end users.

At present all our users are local users and have local passwords.

I have linked the Test CUCM to AD and used a Custom Filter to ensure only two users are synced.

One user did not exist in CUCM as a local user and one did.

The user that did exist already then suddenly has their account constantly locking in AD, the event logs show the CUCM test server as the source of the lock. The only way to stop it locking is to remove the AD sync.

Weirdly enough the AD user which did not exist as a local CUCM user during the sync has had no issues.

Has anybody had this before?

Thanks

[Jaime Valencia]

Is that user being used in some service, or associated to something which might be sending authentication requests and causing this?

[devils_advocate]

Hi Jamie

No, it's just a standard user account. We are using a separate service account for the AD link.

it only happens to the user who is a local user at the time I configure the AD sync within CuCM

As soon as I disable the link to AD, their account no longer locks constantly

Thanks

[Jaime Valencia]

The sync itself does not lock any account just because, you'd need to find out exactly what is the cause for the account locking, most likely it will be due to authentication failure, but CUCM just sends the simple BIND it received from an app like Jabber.

I'd probably look at LDAP logs or even a sniffer to confirm you're sending authentication requests that are causing this.

[majedataoui]

Hi,

I have the same problem, I opened a case and cisco tac not find any think to resolve the issue.

I tell you update when I have a feed back.

CUCM version: 10.5.2

[devils_advocate]

Oddly enough mine only locks one account out.

I did a test import of 10 accounts, 9 were fine and the same one locked out again!