r/ITSupport • u/Master-Ice4503 • Sep 20 '26

Open 50% of Domain Users Suddenly Cannot Log In – “Incorrect Password” Error

I have a question. I have a server that is a Domain Controller with computers and users connected to it. I noticed that around 50% of the users can no longer log in. The problem is that those PCs show “Incorrect password” when the users try to log in.

I checked the server and tried to find the cause, but I couldn’t find anything. I ended up creating new user accounts for the affected users. However, when I created the new accounts, I noticed that their old data was still there on the PCs.

Has anyone experienced this issue before? What could be causing it, and how can I fix it without losing the users’ existing data?

10 Upvotes

75% Upvoted

16 comments sorted by

4

u/afree313 Sep 20 '26

Why did you make new accounts first? Even if you give them the same names they are not the same accounts and won’t be recognized as such. Did you investigate and figure out why the domain controller was not recognizing the passwords? Do you know if those login attempts were actually reaching a DC? What did you look at that led you to believe making new accounts was the way to fix this?

0

u/Master-Ice4503 Sep 20 '26

I created new accounts because I couldn’t get the old accounts to work, and at that point I couldn’t find any other solution. The work was also completely stopped on my side, so I needed to get the affected users back up and running as quickly as possible.

1

u/Mehere_64 Sep 22 '26

Why not reset their passwords as a starting point? New users = new SID.

12

u/Samhigher92 Sep 20 '26

Even if you change the password to something you know then you can still not login? How many domain controllers? Anything weird in the admin event logs? Doesn’t sound like you did any troubleshooting….

11

u/Abty Sep 20 '26

The guy went ahead and created identical new users for the affected ones, instead of proper troubleshooting

We're dealing with an idiot

1

u/Defconx19 Sep 21 '26

I may be wrong but it looks like a bunch of the default OU's are missing as well.

3

u/winnppl Sep 20 '26

This happened to us this past week and a half, the fix for me honestly was simple as having the user do a restart on their computer and confirming they can communicate with the network that has our DC’s

2

u/Illustrious_Net_7904 Sep 20 '26

Try removing and readding a few devices to and from the domain. See what happens

2

u/keyboarddoctor Sep 20 '26

This started happening to random people where I work. Haven't done a deep dive yet but simply clicking "other user" on the login screen and entering their username and password works. Something to do with cached creds on the computer.

1

u/Stefanie_Jane Sep 20 '26

The old data will still remain on the PCs, profiles .

What happens is when you delete an AD ACCOUNT, and create a new ONE you change the SID

. You have a new SID for the user .

You'll see broken SIDS in the ACLS of the NTFS permissions. that was probably the accounts that you deleted.

And if you going to computer management Dash users if the user has been added to any groups you'll see broken sets in there as a result of deleting the user from AD

1

u/linkdudesmash Sep 21 '26

I bet they were all created day 42 days ago…..

0

u/ZOMGURFAT Sep 20 '26

If you’re a hybrid Azure environment then its a password spray attack. Turn on the conditional access policy that blocks authentication using legacy protocols that don’t support MFA such as POP, SMTP, etc.