Re: Local user accounts constantly locking out - please help!

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 01/28/05 

Date: Fri, 28 Jan 2005 08:23:13 -0700

"Paul Dussault" <paulduss@hotmail.com> wrote in message
news:uHDUHpTBFHA.3840@tk2msftngp13.phx.gbl...
> Hi All,
>
> Windows 2000 Server SP4. Ran without a glitch for 2 years.
> Member server, not a DC. Used primarily as Web and FTP server.
> Behind a Firewall.
> Since a few days, local user accounts (including IUSR, IWAM, etc.) are
> constantly locking out. The won't stay unlocked for more than a few
minutes.
> No special settings in group policies, all default settings.
> Nothing obviously wrong in Logs.
>
> The only anomalies I could spot are:
>
> - that the License Logging Service on the DC refuses to start. Could this
be
> related?

not likely

> (I can ping the DC from the Web server).
>
> - the Firewall logs indicate MANY port 138 scans from 2 or 3 machines on
our
> network - always the same ones. Could this be related?
>

highly likely
deny these machines all access then have a tech get to then

> Any hint would be greatly appreciated!!!
>
>
> TIA
>
> Paul Dussault, MCP
>

While you may have a malicious user at those machines, it is more
likely that you have some machines that need to be reformatted and
reimages as they have become "infected".

see also:

Account Lockout and Management Tools
http://go.microsoft.com/fwlink/?linkid=16174 

-- 
Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA

Relevant Pages