From: Matt Scarborough (
Date: 11/27/02

From: Matt Scarborough <>
Date: Wed, 27 Nov 2002 08:54:49 +0000

On Mon, 25 Nov 2002 06:08:18 -0800, Jim wrote
> Can any one tell me what this and why its showing up in my
> servers. I found it in c:\windows\debug directory.

lsass.exe creates this log.

Windows 2000 automatically changes TsInternetUser's password daily. This is why you
see the attempts at
11/07 17:00:28
11/08 17:00:28
11/09 17:00:28
11/10 17:00:28
It appears TSInternetUser's password change is failing due to Access Denied
(0xc0000022). This is in contrast to denzilj's attempt that failed due to not meeting
complexity requirements (0xc000006c).

You can turn on auditing for success/failure of account management events to get a
clearer picture what is happening here.

11/06 17:00:28 Attempting password change server/domain SCS-DISTRICT for user
11/06 17:00:28 SamChangePasswordUser2 on machine \\SCS-CENTRAL2 for user
TsInternetUser returned 0xc0000022
11/06 17:00:28 SamChangePasswordUser2 retry on machine \\SCS-CENTRAL2 for user
TsInternetUser returned 0xc0000022
11/07 16:19:36 Attempting password change server/domain SCS-DISTRICT for user denzilj
11/07 16:19:39 SamChangePasswordUser2 on machine \\SCS-CENTRAL2 for user denzilj
returned 0xc000006c

Matt Scarborough 2002-11-27

Relevant Pages

  • RE: Terminal Services Logons
    ... Why not just reboot the servers. ... "Leo Perrero" wrote: ... > After a password change, this account is getting locked out every 15 minutes ... > because of active terminal services sessions that are using the old password ...
  • id lock out
    ... password change on App Pools under IIS, and about 100 batch files, on our ... servers, If I forgot something and the ID gets locked out due to a bad ...
  • domain account password change
    ... Is there a way to push a password change to all servers ... for a domain account? ...
  • Re: Can anyone verify that MX records for are broken?
    ... name servers for are in the domain. ... That stuff about glue records was a quote from a web site ... Now they say "The glue provided by your nameservers does not ... Now I'm seeing two of the nameservers showing, ...
  • Scarborough Seafest
    ... For some reason the information is late this year and Klondike's web page ... isn't showing up on any servers so... ... Barbeques on fire by the chalets past the castle headland ...