Account Lockout -- ARGH

From: Grabowski, David (david.grabowski_at_us.mizuho-sc.com)
Date: 08/14/03

  • Next message: Harlan Carvey: "Re: Detecting Blaster" 
    Date: Thu, 14 Aug 2003 16:05:28 -0400
To: "SecurityFocus-MS (E-mail)" <focus-ms@securityfocus.com>

    I'm running into some serious problems with users on our domain getting their accounts locked out repeatedly.

    All W2K, SP3.

    No services are configured to run as any of these users.

    Usually in the morning, when the users log in, they let us know that their accounts are locked out. Occasionally problems pop up during the day -- i.e., a user closes Outlook and then restarts it at some point later. Somehow, his account got locked during that time, so Outlook won't start for him.

    All security events are logged.

    Event logs on the workstations vary; some show a number of 529's (unknown username and password) followed by an account lockout. Others simply show the lockouts and nothing else. Some show nothing at all.

    Event logs on the domain controllers show occasional 677's (service ticket request failed - although from what I've read, these are normal), and frequent 675's (pre-authentication failed).

    I've done the requisite research at eventid.net, the MS KB, and Google; nothing of any significance.

    Users are not logged on at more than one workstation. Actually, we recently got everyone into the habit of remembering to log off at the end of the day. (They learned after we started pushing updates that would reboot their machines at night and their open documents wouldn't get saved)

    Time is synchronized on all machines.

    Our Default Domain Controllers Policy enforces: Account lockout duration (0), Account Lockout Threshold (10 invalid attempts), and Reset account lockout counter after (60 minutes)

    Any ideas?

    ---------------------------------------------------
    David Grabowski
    Mizuho Securities USA, Equity Division
    (212) 209-9349
    #####################################################################################
    CONFIDENTIAL: This e-mail, including its contents and attachments, if any, are confidential. It is neither an offer to buy or sell, nor a solicitation of an offer to buy or sell, any securities or any related financial instruments mentioned in it. If you are not the named recipient please notify the sender and immediately delete it. You may not disseminate, distribute, or forward this e-mail message or disclose its contents to anybody else. Unless otherwise indicated, copyright and any other intellectual property rights in its contents are the sole property of Mizuho Securities USA Inc.
         E-mail transmission cannot be guaranteed to be secure or error-free. The sender therefore does not accept liability for any errors or omissions in the contents of this message which arise as a result of e-mail transmission. If verification is required please request a hard-copy version.
         Although we routinely screen for viruses, addressees should check this e-mail and any attachments for viruses. We make no representation or warranty as to the absence of viruses in this e-mail or any attachments. Please note that to ensure regulatory compliance and for the protection of our customers and business, we may monitor and read e-mails sent to and from our server(s).
    #####################################################################################

    ---------------------------------------------------------------------------
    Your network firewall and IDS products do not prevent Web application
    attacks - the most common form of online exploitation- resulting in Web
    defacement, data theft, sabotage and fraud.
    KaVaDo is the only company that provides a complete suite of Web
    application security products.
    Download a FREE whitepaper on "Security Policy Automation for Web
    Applications":http://www.securityfocus.com/Kavado-focus-ms
    ---------------------------------------------------------------------------

  • Next message: Harlan Carvey: "Re: Detecting Blaster"

    Relevant Pages

    • RE: Account Lockout -- ARGH
      ... Most were the Terminal Service Connection that Art spoke of. ... Subject: Account Lockout -- ARGH ... All security events are logged. ... Your network firewall and IDS products do not prevent Web application ...
      (Focus-Microsoft)
    • RE: Account Lockout -- ARGH
      ... All security events are logged. ... Event logs on the workstations vary; some show a number of 529's followed by an account lockout. ... Your network firewall and IDS products do not prevent Web application ... KaVaDo is the only company that provides a complete suite of Web ...
      (Focus-Microsoft)
    • Re: Interactive logon priveleges have been disabled
      ... Did you enable the security policy "Audit: Halt the system if unable to log ... Then close regedit, and start/run "secpol.msc". ... Please contact your system administrator" ...
      (microsoft.public.windowsxp.security_admin)
    • Re: IP Logging in the Security Event log
      ... If you want/need IP security events in the event viewer have a look at: ... servers, you should have a look at application firewalls (there are a few ... IP security policy for DMZ servers is trivial(regardless of its physical and ...
      (microsoft.public.win2000.security)
    • Re: User Login Logging
      ... You don't need a DC to enable auditing. ... Use the default security ... > I don't know where I would enable auditing of security events on ... I don't have a TS-specific login script ...
      (microsoft.public.windows.terminal_services)
    • Quantcast