The error code was: 3221225578

From: DELILAMA (google@delilama.net)
Date: 12/18/02 

From: google@delilama.net (DELILAMA)
Date: 17 Dec 2002 23:17:07 -0800

I have seen many a thread about getting errors
in their auditing when it shows an actual logged in user getting
authentification errors -every 5 minutes!

Like the following:

This is the text of event 681:
The logon to account: Administrator

by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

from workstation: OAK

failed. The error code was: 3221225578

----end sample-----------
This happened after I changed the admin password-
The admin can still log in fine-but the auditing log shows the error
every 5 minutes

Now most of us have the admin accoun tset to
"Password Never Expires"

Perhaps when changing passwords-this setting causes a problem >?

So I unchecked this option-
changed the password again-
then re -checked "Password Never Expires"

And now the auditing error has gone away

Just passing the info on.

Relevant Pages

  • Re: How can admin not have access to certain shares?
    ... Auditing the data so that you are alerted when someone accesses it is ... If you don't trust the administrator then you're screwed to start with. ... defining and managing a reasonably well tuned and managed network ... all access to these documents in any way for any purpose by our admin. ...
    (microsoft.public.windows.server.security)
  • Re: Password Visibility
    ... If an admin can set up a website with basic auth and convince the user to enter their userid/password they can retrieve that password from the vars. ... If an admin has the ability to sniff traffic in and out of a DC and some LDAP app the user is using is using simple authentication the password will be in clear text on the wire. ... You can audit who changes password with normal AD auditing, I suggest reading up on the topic as it isn't something you just want to go slamming into place as there are performance impacts that can occur. ... is there a way of auditing which administrator reset a user's password and when? ...
    (microsoft.public.windows.server.security)
  • User log
    ... If he's an admin, he can simply turn off or erase any ... logging or auditing you can turn on. ... >Is there any way i can trap anyone, ...
    (microsoft.public.windowsxp.security_admin)