Users may experience account lockouts due to XDR services.

Chilla — Tue, 13 Jun 2023 03:31:20 GMT

Dear Community,

After modifying the password for a Windows user, the user account is continually locked out.
Using Process Monitor, it was discovered that the XDR service (cyserver.exe) read cached credentials(C:\ProgramData\Cyvera\LocalSystem\Python\payload\grpc\_cython\_credentials).
At approximately the same time, the lsass.exe process began sending authentication information to AD.
Therefore, it is likely that the user account was locked out as a result of reading cached credentials around the same time.

May I ask what is stored in this path?
C:\ProgramData\Cyvera\LocalSystem\Python\payload\grpc\_cython\_credentials

Has anyone experienced a similar situation before?

Thanks.

Re: Users may experience account lockouts due to XDR services.

mavraham — Tue, 13 Jun 2023 13:34:29 GMT

Hi @Chilla, thank you for writing to Live Community.

This sounds like a very specific issue, and if it may have been as a result or Cortex XDR I highly suggest opening a support ticket through our customer support portal. and have them take a look at the issue.

topic Users may experience account lockouts due to XDR services. in Cortex XDR Discussions

Users may experience account lockouts due to XDR services.

Re: Users may experience account lockouts due to XDR services.