Re: NT Message

From: H C (keydet89@yahoo.com)
Date: 11/01/01 

Message-ID: <20011101163730.17702.qmail@web20506.mail.yahoo.com>
Date: Thu, 1 Nov 2001 08:37:30 -0800 (PST)
From: H C <keydet89@yahoo.com>
Subject: Re: NT Message
To: Steven Bonici <sbonici@groupea.com>, "'focus-ms@securityfocus.com'" <focus-ms@securityfocus.com>

Steven,

The message is being generated as a result of the user
being locked out of the system, not the other way
around.

What you should be looking at is EventLog entries
prior to this event..._IF_ you have auditing for
failed logon events enabled.

What is your domain account policy? Do you have the
account lockout policy set to 3 failed login attempts?
 If so, you should see three failed login attempts
prior to this event.

Another avenue to gain information is to search the
Microsoft MSDN site (KnowledgeBase articles in
particular) for the message number.

What you do from this point depends on your policies.

--- Steven Bonici <sbonici@groupea.com> wrote:
>
> We have recently started getting these messages, and
> I am not sure as to
> why. Can someone let me know what these are and why
> this would start
> happening? It keeps locking users out of the
> Network.
>
>
> 11/01/2001,12:00:43 AM,Security,Success
> Audit,Account Management ,644,NT
> AUTHORITY\SYSTEM,EDISON01,User Account Locked Out:
> Target Account Name: TSmith
> Target Account ID:
> S-1-5-21-2060728834-239620936-1971066577-1005
> Caller Machine Name: \\TSmith
> Caller User Name: SYSTEM
> Caller Domain: NT AUTHORITY
> Caller Logon ID: (0x0,0x3E7)
>
>
> Any assistance would be appreciated, Thanks.
> Steven

__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com

Relevant Pages

  • Re: OE & Yahoo Mail
    ... I receive mail from 4 yahoo accts on my PC, ... YahooPOPs *emulates* UIDL by using the message-ID from the URL returned ... unique for the life of a freebie Yahoo webmail account but it has been ... incoming mail, which causes me to have to use Port 123 for YPops, on the ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: OE & Yahoo Mail
    ... I receive mail from 4 yahoo accts on my PC, ... YahooPOPs *emulates* UIDL by using the message-ID from the URL returned ... unique for the life of a freebie Yahoo webmail account but it has been ... incoming mail, which causes me to have to use Port 123 for YPops, on the ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Help with OE 6/IE 7
    ... Have you obtained new email addresses from Yahoo and TDS? ... OE stops responding whenever I switch to it, ... I haven't tried uninstalling IE7, ... If you add the TDS account to the first identity above (the one running ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Help with OE 6/IE 7
    ... Have you obtained new email addresses from Yahoo and TDS? ... I haven't tried uninstalling IE7, ... If you add the TDS account to the first identity above (the one ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: [Full-disclosure] Yahoo recommends you write down account information
    ... Like I marked up earlier in this thread, its not about how an account would ... The highlight of the thread is that once again i've proved Yahoo does not ... way they don't take the threat of folks following folks home to break into ... MARK, you're Yahoo's top security advisor, and I respect you off ...
    (Full-Disclosure)