account lock out

From: Juan Carlos (jore@comexperu.org.pe)
Date: 01/23/03


From: "Juan Carlos" <jore@comexperu.org.pe>
Date: Thu, 23 Jan 2003 14:43:02 -0800


Me too. Some users suddenly got locked out without any
reason. I searched in the
event viewer and found this:

***********************
Date: 21/01/2003 Source: Security
Time: 15:14 Category: Logon/Logoff
Type: Failure Event ID: 529
User: NT AUTHORITY\SYSTEM
Computer: COMEXCENTRAL

Logon Failure:
Reason: Unknown user name or bad
password
User Name: jore
Domain: COMEX
Logon Type: 2
Logon Process: Advapi

 Authentication Package:
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Workstation Name: COMEXCENTRAL

**********************

Where COMEXCENTRAL is the PDC and I'm using W2K. This
event repeats aprox. 5 times in a second and blocked the
account. I had cheked fro scheduled tasks that may cuase
this problem but i didn't found nothing.

I'm thinking of this as an attack, but I'm not really
sure of that.

>-----Original Message-----
>I seem to be having the same problem, it happens right
>after a user changes their password. The only way I
have
>found to fix it is to delete their profile (both the
>cached copy on their workstation and the one on the
>server). Then everything seems to work normal until
they
>have to change their password again.
>
>Does anyone have a solution that doesn't involve
deleting
>their profiles?
>
>
>>-----Original Message-----
>>I am haveing a problem with users getting locked out
for
>>no apparant reason and it is not logged in event viewer
>>that the users account failed to log on. Sometimes the
>>users can not log into their Outlook account even
though
>>they are logged on the network. I am running 2000
>Server
>>on the network and the problem happens to either 2000
>pro
>>or XP pro clients.
>>
>>Thank you,
>>
>>C. Van Derbilt
>>.
>>
>.
>



Relevant Pages

  • users that are getting locked out by Advapi
    ... I got a very strange problem because some users suddenly ... got locked out without any reason. ... event viewer and found this: ... Logon Failure: ...
    (microsoft.public.win2000.security)
  • RE: Virus is getting domain account listing
    ... The Event Viewer logs on the PDC's was the way ... I was able narrow down which machines the Failed logon request was ... I found that the Virus definitions on those machines were ... Virus is getting domain account listing ...
    (Focus-Microsoft)
  • Re: Keyboard freezes after Login
    ... Is there something installed in that account that isn't installed in any ... Also try checking a event viewer for errors that correspond ... error and you can paste it into a message, perhaps we can decipher it. ... > keyboard freezes. ...
    (microsoft.public.windowsxp.accessibility)
  • Registry Error
    ... The Event Viewer can be found on the Administrative Tools Menu ... service was still using the registry during log off. ... This is often caused by services running as a user account, ... How do I find out what serviceare running as a user account? ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Not Creating Computer Accounts - Strange Issue
    ... I use the domain admin account to re add the computers to the domain. ... Are you saying i need to wait for replication of the computer ... Also post the complete error from the event viewer. ... workgroup, reboot, rename pc, reboot, rename back and then bring it ...
    (microsoft.public.windows.server.active_directory)