Account locking out

From: Molnir (Molnir_at_discussions.microsoft.com)
Date: 06/28/05 

Date: Tue, 28 Jun 2005 07:39:16 -0700

I'm on a Windows 2000 domain. We're on a single site with 3 DCs, all
configured as GCs. There are approximately 350 users.

We have a service account that's suddenly continually locking itself out. I
understand that someone somewhere has probably configured something to start
using the credentials of this account and probably fat-fingered the password,
but I need to determine this down to a machine if possible. We have about 35
servers and it will be a huge headache to scour every single machine.

The security event log doesn't seem to show me the machine that the lockout
is occurring on. The log is set to have a max size of 100 MB and overwrite
events as needed; I've exported it to prevent anything relevant from being
overwritten. The domain auditing policy is as follows:

Account Logon Events S, F
Account Management S ,F
Directory Service Access S, F
Logon Events S, F
Object Access S, F
Policy Change S, F
System Events F

Any help would be appreciated.

Relevant Pages

  • Re: How to Repair Install Windows XP??
    ... First, check that your security event log is not full, as it is ... such things as a login script that bombs can ... you account is not the built-in Administrator account. ... The built-in Administrator account is often left by OEMs ...
    (microsoft.public.windowsxp.security_admin)
  • Re: XP Administrator account lock
    ... > both the passwords and the account against the SAM entry, ... > I am able to remotely access the machine to get to the ... I have tried to overwrite the ... > cannot access that area of the disk. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Spammers die!
    ... Well I checked the security event log.. ... There are repeated Account Logon 680, Logon/Logoff 540, Privilege Use ... What is surprising is that I installed Exchange 2 ...
    (microsoft.public.exchange.setup)
  • Re: Spammers die!
    ... Well I checked the security event log.. ... There are repeated Account Logon 680, Logon/Logoff 540, Privilege Use ... What is surprising is that I installed Exchange 2 ...
    (microsoft.public.inetserver.iis.smtp_nntp)
  • Re: Spammers die!
    ... Well I checked the security event log.. ... There are repeated Account Logon 680, Logon/Logoff 540, Privilege Use ... What is surprising is that I installed Exchange 2 ...
    (microsoft.public.exchange.misc)