Jump Cloud: User Lockouts (Random, After Removing Local Admin Priviledge)

Collect Logs

https://jumpcloud.com/support/use-jumpcloud-log-collection-scripts


Troubleshoot

https://jumpcloud.com/support/use-logs-to-troubleshoot-user-lockouts-on-windows-devices


May be caused by:

  • Saved Windows Credential
  • Scheduled Task using orphaned credentials

On local machine,  run PowerShell as 'Admin' to identify what scheduled task is using this user's credentials in that device I think that

  • Option 1:     Get-ScheduledTask | Where-Object { $_.Principal.UserId -like "*USERNAME*" } | Select-Object TaskName, TaskPath, State
  • Option 2:     Get-ScheduledTask | where { $_.Principal.UserId -like "*USERNAME*" } | select TaskName, TaskPath, State

Run TaskScheduler as 'admin'

  • Update Credentials or Disable Tasks: 

    Locate the scheduled tasks listed above (check both the root \  folder and subfolders like \Mozilla\ ).

  • For each task:
    • If the task is still needed: Right-click the task, choose Properties, click Change User or Group, enter , and re-enter the updated password when prompted. - or -
    • If the task is unnecessary: Right-click and select Disable or Delete.