Re: IIS5 Integrated Windows Authentication prompts password

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 05/22/03 

Date: Thu, 22 May 2003 14:44:01 +1000

Start auditing for failed logon attempts.

The message below indicates that the account has *already* been locked out,
hence it is failing additional attempts to login. Account lockout indicates
that someone, somewhere is attempting to logon to the user account and
failing the password. Make sure that it isn't someone else attempting to
guess this person's password...

Cheers
Ken

"Nick Miron" <nicolas.miron@cgi.com> wrote in message
news:6a4c3d36.0305211128.33b3cdd6@posting.google.com...
: Turns out there is an event in the Security log:
:
: Event Type: Failure Audit
: Event Source: Security
: Event Category: Logon/Logoff
: Event ID: 539
: Date: 5/20/2003
: Time: 10:19:55 AM
: User: NT AUTHORITY\SYSTEM
: Computer: DM1CT3
: Description:
: Logon Failure:
: Reason: Account locked out
: User Name: murroach
: Domain: BELL
: Logon Type: 3
: Logon Process: NtLmSsp
: Authentication Package: NTLM
: Workstation Name: ATRC47
:
: For more information, see Help and Support Center at
: http://go.microsoft.com/fwlink/events.asp.
:
: Also, since it's always the same 3-4 users getting the problem, I'm
: thinking it's somehow related to their NT account. If it were an
: intermittent problem with the IIS server, random users would be having
: the problem - but hta'ts not the case - it's always the same 3 or 4
: who are getting prompted once in a while.
:
: I looked at the NT account difference between one who's getting
: prompted, and one who never did, and I couldn't see anything
: different...
:
:
:
: "Ken Schaefer" <kenREMOVE@THISadOpenStatic.com> wrote in message
news:<#HJNiH0HDHA.2204@TK2MSFTNGP11.phx.gbl>...
: > Is there anything in the Windows Event Log? (eg Logon Failure with
: > appropriate Event ID and message?)
: >
: > Maybe you are running out of licences, or there is something other
problem,
: > which may become clearer is there is something being logged to the Event
: > Log.
: >
: > Cheers
: > Ken

Relevant Pages