Forum Discussion
Azure ATP Service Account getting locked out
MicrosoftThe sensor is using those credentials for various scenarios for authentication, for LDAP, for name resolution, for lateral movement mapping...
The thing is that if one of the sensors was using a wrong password, it should have failed starting...
Are you using just a single set of credentials?
Idea:
create new set of credentials for AATP, and replace in the portal.
make sure not to disclose the credentials to anyone else.
After all sensors get synced with the new credentials, unlock the old account and see if it still locks out.
If it does, there is something other than AATP that is trying (and fails) to use this account, and you might want to trace who is it by increasing auditing in the DC.
EliOfek i uninstalled the agent on each DC and then reinstalled it. The account got locked out again using the new account. i checked the error log on the offending agent, and this is what it showed:
2019-10-03 17:55:08.1794 Error DomainNetworkCredentialsManager GetInternal failed [domainName=med]
our domain name in the Azure ATP portal on the Directory Services tab is not "med". it is "domainname.med".