Domain accounts keep getting locked out by the BCAAA Service. The Active Directory (AD) server log indicates the domain account is being locked out due to the process name bcaaaa-realm.exe.
BCAAA version 6.1.4 and later
If the BCAAA service is showing as the cause of the lockout in the AD server logs, applications are sending the wrong credentials to the Edge SWG.
This could be caused any machine using the wrong (or old) user credentials.
If this is occurring frequently for specific users, check their machine to see if any applications (besides the browser) are using saved credentials.
To resolve this issue, you must identify the offending users and machines then remedy the issue (incorrect/old credential) on the end user machine. Here is a list of steps to find the users or machines with this issue:
2022/01/20 08:08:24.403 [6428] [6976:6428] Failed NTLM Authentication for user: 'DOMAIN\adminuser'; status=1909:0x775:The referenced account is currently locked out and may not be logged on to.
https://<proxy-ip>:8082/Eventlog/download/events.log
and save the output as eventlog.txt
DOMAIN\adminuser
Authentication failed from <xx.xx.xx.xx>: user 'DOMAIN\adminuser', realm='<realm-name>'
All authentication requests by the Edge SWG will now be logged to this trace file. After the user lockout occurs, you will then be able to search this trace file for all transactions related to that particular user and then determine what IP addresses the requests came from, narrowing the search for the service that has the expired/invalid credentials
Caution: Monitor the Edge SWG closely while this Trace is active, as it will require more resources than it typically uses. Verify the Policy trace will not be too resource intensive on the Edge SWG before letting it run unattended for long periods of time.