Re: Strange Win2K Logon Problem

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 09/10/04 

Date: Fri, 10 Sep 2004 00:01:28 GMT

Enable auditing of logon events on that computer and account logon events in Domain
Controller Security Policy [if nit already] and view the security logs to see if
failed logon attempts have been generated. You will have to view the security log on
the computer and the security log on the domain controller that tried to authenticate
her. Often the events will give specific information on why the logon failed. I would
also run the support tool netdiag on that computer to check for network/domain
problems. One possibility is that cached logons are used on that computer and she has
since changed her password. The links below go into more detail on how to configure
auditing and interpreting the Event ID's. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;300549

http://www.microsoft.com/resources/documentation/WindowsServ/2003/datacenter/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/datacenter/proddocs/en-us/518.asp

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

"SWBradbury" <swbradbury@netzero.com> wrote in message
news:e3fc3749.0409091204.51a50ca0@posting.google.com...
> Hello all!
>
> Has anyone ever seen a user have a problem where they can log into one Win2K
> machine just fine but when they try to log into another they get the
> following message?
>
> "The system could not log you on. Make sure your user name and domain are
> correct, then type your password again. Letters in passwords must be typed
> using the correct case. Make sure that Caps Lock is not accidentally on."
>
> The thing that is really strange to me is that, not only can she log in
> elsewhere, but on the machine that is giving the above error she is the only
> one that has the problem -- Other users can log in normally.
>
> Any help would be appreciated.
>
> Thanks,
> SWBradbury

Relevant Pages

  • Re: LOG ON to win2000
    ... You would have to enable auditing of either account logon or logon events in ... Local Security Policy and then view the security log in Event Viewer. ... enable auditing of logon events. ...
    (microsoft.public.win2000.security)
  • Re: Task Scheduler
    ... Try enabling auditing of logon events for successes and failure and privilege use for ... failure on that computer and look in the security log in Event Viewer to see if ...
    (microsoft.public.win2000.security)
  • Re: Domain logon auditting - need help
    ... controller security policy and "logon" events in Domain Security Policy. ... domain and make sure you increase the size of the security log quite a bit ...
    (microsoft.public.windows.server.security)
  • Re: Tracking unauthorized access to my computer
    ... Remote Desktop. ... The user name, logon type, and time can give you an idea who is ... Also look at your own logon events for your user account ... I would also increase the size of the security log to like ...
    (microsoft.public.security)
  • Re: Event 529 occuring 2500 times every day
    ... I am receiving this error message in my security log about 2500 ... Logon Failure: ... User Name: HSSSERVER$ ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)