If it's the admin account, there would be a pretty good likelihood of bruteforce attempts if your server is on the internet. One option is to rename it to something else. <div class="gmail_quote">On 17 May 2016 11:36 a.m., "Rich Megginson" <<a href="mailto:rmeggins@redhat.com">rmeggins@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 05/17/2016 08:18 AM, Rob Crittenden wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> John Duino wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Is there a (relatively easy) way to determine what is causing a user account to be locked out? The admin account on our 'primary' ipa host is locked out frequently, but somewhat randomly; sometimes it will be less than 5 minutes it is available, and other times several hours. ipa user-status admin will show something like: Failed logins: 6 Last successful authentication: 20160516214142Z Last failed authentication: 20160516224718Z Time now: 2016-05-16T22:52:00Z ipa user-unlock admin does unlock it. But parsing through the various logs on the affected host doesn't give me what I need to know, primarily, which host(s) are trying to access admin and causing it to lock. FreeIPA 4.2.0 on CentOS 7.2.1511 </blockquote> I think you'd need to poke around in the KDC and 389-ds access log to find the auth attempts. I guess I'd look for PREAUTH_FAILED in /var/log/krb5kdc.log and look for err=49 in the 389-ds logs and then correlate the conn value with a BIND to see who was authenticating. </blockquote> For 389 you can use the <a href="http://logconv.pl" rel="noreferrer" target="_blank">logconv.pl</a> tool <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> rob </blockquote> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div>