How to Find out What host is Sending Failed LDAP attemps from CUCM

[jecker]

Hello,

I have a strange issue.  I have a customer who has CUCM / UCCX / Presence and Unity Connection installation on a BE6k.  A couple times a week one of the users is reporting that her account is locked out.  When we take a look at the audit logs on the AD servers all the failed attempts are coming from the CUCM subscriber (usually about 10 failed attempts in a 3 minute time frame).  I've verified this in the CUCM tomcat security traces, however I can't find any logs that shows me the device that the attemps are comming from.

This user is a Jabber / UCCX user so it could be one of these applications.  The strange part is sometimes she is locked out when her primary machine isn't even on.  Obviously it might be another device on the network she has logged into but i'm wondering anyone knows of any traces that may help me.  I've looked the regular tomcat logs but didn't find any detail there. 

Thanks.

[Johnkodet]

We are having a similar issue.  We started using Cisco AnyConnect about a month ago full time (Not sure if this has any bearing on issue).  We have Cisco Jabber for Windows version 10.6 (Under advanced settings, Account type is set to Cisco IM and Presence with use following server checked and our Cisco Unified CM IM and Presence Administration Server IP entered), and when the user attempts to login to jabber, our CUCM Service Account (CUCMLDAP) locks out and nobody can login to Jabber, or any of our GUI interfaces for CUCM, Agent or Supervisor Software for UCCX.  We are having to unlock the service account many times a day.  Any assistance would be greatly appreciated.

Thanks