Hi,

We are facing issues, very frequently users complain account locke outs

1. We will trace the Logs in DC & it will point to Exchange 2013 Multi role servers

2. We try to dig exhange server for the logs - Please let us know what logs we need to concentrate on Exchange Server 2013?What is the standard procedure for this scenario? to dig the source computer from Exchange 2013 server logs?

You could parse the IIS logs.

Thank you.

What is the query we can input for fetching details in th eIIS logs?

The IIS logs are text file.  I believe you can open them in Excel as space delimited records.

Please checkout this informative technet resource that covers almost all the required steps in order to deal in such critical situation and resolve this weird issue in quick manner : http://blogs.technet.com/b/instan/archive/2009/09/08/the-case-of-the-mysterious-account-lockout-coming-from-exchange.aspx

Hi,

We can use Log Parser to analyze IIS log, the output of Sc-Win32-status might point out the root cause.
For your reference: http://messagingadmins.blogspot.com/2014/08/troubleshoot-exchange-cas-server-is-lockout-source.html

Meanwhile, a common problem is a user with multiple devices that try to connect with an out of date password and lock out the account.

Hi Manju,

Just you give you headsup, what is most likely happening here is that your account is getting locked out due to ActiveSync or OWA access by a device connecting via CAS.