Re: User locked out with event 537 under type 11 logon

From: Gijtech (junk_at_gijoes.com)
Date: 11/14/05 

Date: Mon, 14 Nov 2005 08:39:08 -0800

well that didn't work. still getting the same one fail lockout. with the cached logon disabled.
  "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message news:%23Yebbpa5FHA.1140@tk2msftngp13.phx.gbl...
  Open Local Security Policy on his computer and then go to local policies/security options and make sure
  that it shows zero as the number of previous logons to cache to see if that helps. --- Steve
    "Gijtech" <junk@gijoes.com> wrote in message news:%23MY7whX5FHA.3312@TK2MSFTNGP15.phx.gbl...
    I have a user logging in to the domain from a Win xp sp2 system, who after successfully logging into the domain then logs on to our intranet views an office document then enters the back command and finds his account locked out.

    looking at the event log on the users system reveals one entry of
    Logon Failure: Reason: An error occurred during logon
    User Name: username
    Domain: domain
    Logon Type: 11
    Logon Process: User32
    Authentication Package: Negotiate
    Workstation Name: computer name
    Status code: 0xC000005E
    Substatus code: 0x0

    followed by

    Logon Failure:Reason: Account locked out
    User Name: username
    Domain: domain
    Logon Type: 2
    Logon Process: User32
    Authentication Package: Negotiate
    Workstation Name: computer name

    at this point the user calls and we rest the account. user lockout is set for 5 fails not 1. we have hklm\Software\Microsoft\Windows NT\Current Version\Winlogon\cachedlogonscount set to 0 so I am at a loss as to why the system is attempting to use a cachedinteractive logon, and why is it failing w/ only one attempt.

Relevant Pages

  • Re: Event ID 537 - Windows Server 2003
    ... An error occurred during logon ... Workstation Name: - ... Substatus code: 0x0 ... Caller User Name: - ...
    (microsoft.public.security)
  • Re: User locked out with event 537 under type 11 logon
    ... I have a user logging in to the domain from a Win xp sp2 system, who after successfully logging into the domain then logs on to our intranet views an office document then enters the back command and finds his account locked out. ... Logon Failure: Reason: An error occurred during logon ... Workstation Name: computer name ... Substatus code: 0x0 ...
    (microsoft.public.win2000.security)
  • Re: Resetting all local policies to default on XP Pro via command line
    ... Tell him to boot into Safe Mode and logon as an administrator and then to ... open Local Security Policy and remove the rules he created but to leave the ...
    (microsoft.public.security)
  • Re: Denied Local Logon but capable of use RunAs
    ... For XP Pro open Local Security Policy and go to local policies/user rights ... and add the user to the user right for deny logon locally. ... > but still allow that specific account to run inside RunAs environment? ...
    (microsoft.public.windowsxp.security_admin)
  • Re: User locked out with event 537 under type 11 logon
    ... Open Local Security Policy on his computer and then go to local policies/security options and make sure ... Logon Failure: Reason: An error occurred during logon ... Workstation Name: computer name ... Substatus code: 0x0 ...
    (microsoft.public.win2000.security)
Quantcast